Latent Injection in Retrieved Document / RAG Context
Attackers hide fake commands inside resumes, reports, emails, or web pages that an AI agent later retrieves and reads. Because the agent treats retrieved text as trustworthy context, it can be tricked into following instructions the attacker planted instead of the real user's request.
How the attack works
An attacker writes text such as 'ADMIN OVERRIDE', 'NEW SYSTEM PROMPT', or 'IGNORE PREVIOUS INSTRUCTIONS' into a document, PDF, email, or webpage that they know or expect an AI agent will fetch and process — for example a job resume submitted to an HR screening bot, or a report pulled into a retrieval-augmented generation pipeline. The agent retrieves this content as part of its normal workflow and feeds it into its context. If the agent doesn't distinguish between trusted instructions and retrieved data, it may execute the embedded commands, overriding its actual task. This differs from injection placed directly in a user's typed request — here the payload rides passively inside content the agent was never meant to treat as instructions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- a1ec6b84-f96e-433e-917b-beacc71f70c6
- Severity
- High
Why it matters
An organization's AI agent can be hijacked to ignore its intended task, leak data, or perform unauthorized actions, triggered simply by having it read a poisoned document, email, or web page rather than requiring the attacker to interact with the agent directly.
What you can do
- →Treat all retrieved document content as untrusted data, never as instructions, and enforce this separation in agent prompts and architecture.
- →Strip or flag suspicious control phrases (e.g. 'ignore previous instructions', 'system prompt', 'admin override') found in ingested documents before passing them to the model.
- →Review RAG and document-processing pipelines for cases where retrieved text can influence agent behavior or tool calls.
- →Expect legitimate false positives from security research papers, pentest reports, and documentation containing injection examples — tune review processes to account for this context.
Known benign look-alikes
- Security research documents describing prompt injection examples
- Agent framework documentation with example payloads in code blocks
- Penetration testing reports containing injection samples as findings