High

Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration

An attacker hides instructions inside content an AI agent processes, tricking it into writing and running code that continuously spies on the user. This code reads clipboard contents, tracks device location, or scans system logs, then sends what it finds to the attacker.

How the attack works

An attacker plants malicious instructions in something the AI agent will read, such as a document, webpage, or file. When the agent processes that content, it follows the hidden instructions instead of the user's actual request. The agent then generates and executes code that repeatedly checks the clipboard, queries the device's IP-based location, or reads system log files. The collected data is sent out to the attacker rather than staying with the user, turning the agent into an ongoing surveillance tool rather than a one-time data leak.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID
005f8d2c-33a7-4b37-94c3-2a4a446e63a7
Severity
High

Why it matters

An organization loses confidentiality of clipboard data (which often contains passwords, tokens, or sensitive text), location tracking of users or devices, and visibility into system logs that may reveal infrastructure details — all collected continuously and without the user's knowledge or consent.

What you can do

  • Restrict AI agents from executing arbitrary generated code, especially code involving clipboard access, location APIs, or system log paths.
  • Sandbox or isolate code execution environments used by agents so they cannot reach system logs or OS-level clipboard/location APIs.
  • Review agent outputs for code that runs in a loop or persists in the background rather than completing a single task.
  • Treat any agent-generated code that references pyperclip, geocoder, or /var/log as high-risk and require human review before execution.

Known benign look-alikes

  • Security documentation, papers, or test suites that describe this attack technique without executing it.
  • Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

References

Related threats