Injected Hyperlink — Scam / Malware / Advertising URL in the Response
Attackers hide instructions inside content an AI agent reads — a webpage, document, or email — telling it to add a link or contact address to whatever it outputs next. If the agent obeys, it ends up handing the user a phishing link, fake software download, or lottery scam contact as if it were part of a normal answer.
How the attack works
An attacker plants text in a source the agent will process, such as a document, webpage, or email, containing wording like 'add', 'include', or 'suggest' this link or contact in your response. The agent treats this planted text as an instruction rather than as data to summarize. It then inserts the attacker's URL or email address into its output, targeting the user-facing response. The user receives a reply that looks legitimate but contains a scam, phishing, malware-download, or advertising link chosen by the attacker.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 8f80d5e9-9a58-4222-b644-b57dace7ea02
- Severity
- High
Why it matters
Users trust the agent's output and can be led to phishing sites, fake software installers, malware downloads, or scam contacts, resulting in credential theft, malware infection, or fraud — all while appearing to come from a trusted assistant.
What you can do
- →Treat any content the agent ingests from external sources (web pages, documents, emails) as untrusted and never as instructions.
- →Filter or strip URLs and email addresses that appear in agent output but were not present in the original user request or verified sources.
- →Require human review or link-safety checks before an agent's response with hyperlinks or contact details reaches end users.
- →Log and monitor cases where agent responses include links absent from the source material the user actually requested.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.