Instruction Injection via Tool Output
When an AI agent calls a tool (a search API, a document reader, a database, etc.), the data that comes back is supposed to be inert information. This rule flags cases where that returned data actually contains commands aimed at the agent itself, trying to make it act on instructions the tool result should never have been allowed to give.
How the attack works
An attacker gets text under their control into some data source the agent will later fetch: a web page, a document, an API response, a database record. That text is written to look like an instruction rather than data — for example an urgent message telling the agent to ignore its prior task, call another tool, hide something from the user, or send data somewhere. When the agent's tool call retrieves this content, it can be tricked into treating it as a legitimate directive instead of information to summarize or process. The rule looks for several telltale signs together — urgency language directed at the agent, direct commands, hidden or steganographic instruction markers, fake system/API-response formatting — to catch this while avoiding normal instructional text.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9119260b-d194-4117-9a41-7279dc8b6637
- Severity
- High
Why it matters
A successful injection can make the agent perform unauthorized actions, leak sensitive data, or silently change its behavior, all while appearing to the operator as if it's just processing a routine tool result.
What you can do
- →Treat all tool and API output as untrusted data — don't let agents execute instructions found inside retrieved content.
- →Sanitize or strip suspicious formatting (fake system tags, hidden text, urgency phrases) from tool responses before they reach the model.
- →Restrict which tools an agent can invoke as a result of processing another tool's output, especially exfiltration-capable ones like network or email actions.
- →Review flagged tool outputs manually to distinguish real injection attempts from legitimate formatting or retry instructions.
Known benign look-alikes
- Tool outputs with legitimate formatting instructions for agent response
- API documentation tools describing how to call other endpoints
- Error messages instructing agent to retry with different parameters
- Workflow orchestration tools that legitimately direct next steps
- Monitoring tools that include 'action required' in their standard output format