Injected Code — Environment-Variable Exfiltration
An attacker hides instructions inside content an AI agent processes, causing the agent to write or run code that reads sensitive environment variables (like API keys and tokens) and sends them to an outside server. This is a way to steal credentials by abusing an AI agent's ability to execute code.
How the attack works
An attacker plants malicious instructions in text the AI agent will read, such as a document, webpage, or tool output. The agent, following these injected instructions, generates or runs code that accesses process environment variables using dictionary-style lookups (os.environ[...]). That code then sends the collected values in an HTTP POST request to a server the attacker controls. The combination of reading environment variables and immediately transmitting them off-host is what marks this as an exfiltration attempt rather than normal code.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 477456f7-13e7-40da-9744-eb1289135f5c
- Severity
- High
Why it matters
If successful, an organization's API keys, authentication tokens, database credentials, or file paths stored in environment variables end up in an attacker's hands, enabling further compromise of connected systems and services.
What you can do
- →Restrict what environment variables are visible to AI agent execution environments; avoid storing long-lived secrets there when possible.
- →Sandbox or isolate agent code execution so it cannot make arbitrary outbound network requests.
- →Review agent-generated code for environment variable access combined with outbound HTTP calls before it runs.
- →Treat any content an agent ingests from untrusted sources (web pages, documents, tool outputs) as potentially containing hidden instructions, and filter or sanitize it.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.