# Injected Code — Browser Cookie / Session-Token Theft

- **Severity:** High
- **Signature ID:** `0f4e6533-1f73-4b01-856b-2bc52c74bdde`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure), LLM05 (Improper Output Handling)

## Summary

This rule flags cases where an AI agent is manipulated into loading a saved cookie file and attaching it to an outbound web request. That lets an attacker hijack a victim's logged-in session without needing their password.

## How the attack works

An attacker injects instructions into content the agent processes, causing it to read a local cookies.txt file or an already-loaded cookie jar. The agent then includes that cookie data in an outbound HTTP request it makes, effectively sending the victim's session credentials to a destination the attacker controls or benefits from. Because the request looks like normal agent-driven browsing or automation traffic, the theft can blend in with legitimate activity. The end result is a valid, authenticated session the attacker can reuse for account takeover.

## Why it matters

An attacker can take over a user's authenticated accounts and sessions without ever obtaining a password, bypassing login and MFA prompts entirely.

## What you can do

- Restrict agent file-system access so it cannot read browser cookie stores or exported cookie files.
- Block or tightly control any agent capability that lets injected content trigger outbound network requests carrying local file contents.
- Review agent logs for requests that combine a cookie-jar read with an external HTTP call.
- Treat any content the agent processes (web pages, documents, emails) as untrusted input that should not be able to direct file access or network actions.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01894

---
Source: https://www.netzilo.com/threats/atr-injected-code-browser-cookie-session-token-theft