Injected Code — Live User-Activity / Location / Log Surveillance Exfiltration
An attacker hides instructions inside content an AI agent processes, tricking it into writing and running code that continuously spies on the user. This code reads clipboard contents, tracks device location, or scans system logs, then sends what it finds to the attacker.
How the attack works
An attacker plants malicious instructions in something the AI agent will read, such as a document, webpage, or file. When the agent processes that content, it follows the hidden instructions instead of the user's actual request. The agent then generates and executes code that repeatedly checks the clipboard, queries the device's IP-based location, or reads system log files. The collected data is sent out to the attacker rather than staying with the user, turning the agent into an ongoing surveillance tool rather than a one-time data leak.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 005f8d2c-33a7-4b37-94c3-2a4a446e63a7
- Severity
- High
Why it matters
An organization loses confidentiality of clipboard data (which often contains passwords, tokens, or sensitive text), location tracking of users or devices, and visibility into system logs that may reveal infrastructure details — all collected continuously and without the user's knowledge or consent.
What you can do
- →Restrict AI agents from executing arbitrary generated code, especially code involving clipboard access, location APIs, or system log paths.
- →Sandbox or isolate code execution environments used by agents so they cannot reach system logs or OS-level clipboard/location APIs.
- →Review agent outputs for code that runs in a loop or persists in the background rather than completing a single task.
- →Treat any agent-generated code that references pyperclip, geocoder, or /var/log as high-risk and require human review before execution.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.