Injected Code — Contact-List Harvest and SMTP Spam Exfiltration
An AI agent can be manipulated into reading a local file of contacts and sending them all an email pulled from a remote source. This spreads spam or malicious content to everyone in the list and leaks the list itself to whoever controls the remote content.
How the attack works
An attacker plants instructions (via prompt injection) that get the AI agent to run code. That code opens a local contacts.csv file to collect email addresses, then fetches content from a remote location the attacker controls. Finally it uses an email-sending library (such as smtplib or yagmail) to send that fetched content to every address in the contact list. The result is both a data leak (the contact list reaches the attacker's infrastructure indirectly through the send) and a spam/malware propagation step, since every contact receives attacker-chosen content.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 702eec32-730d-4dfa-9889-045ac3a8e20b
- Severity
- High
Why it matters
Every person in the contact list receives unsolicited or malicious email, which can carry the attack further, damage the sender's reputation, and get domains blacklisted. The contact list itself — names and email addresses — is exposed to whatever remote source or process handled the outgoing content.
What you can do
- →Restrict AI agents from reading local files like contacts.csv unless the task explicitly requires it.
- →Block or tightly control outbound SMTP access from agent execution environments.
- →Review agent code execution for use of smtplib, yagmail, or similar mail libraries triggered by untrusted input.
- →Require human approval before an agent sends email to more than one recipient or to any external list.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.