Latent Injection - Mixed Embedded Instruction Patterns
Attackers hide commands inside ordinary-looking content — a WHOIS record, a candidate profile, a document summary — hoping the AI agent that processes that content will follow the hidden instructions instead of treating it as plain data. This rule looks for text patterns commonly used to smuggle such instructions in.
How the attack works
An attacker plants text inside data that will eventually be fed to an LLM agent, such as domain registration records, resumes, or documents the agent is asked to summarize. That text includes fake claims of legal authority or explicit injection markers designed to make the model treat the embedded text as a command rather than as content to analyze. When the agent processes this data, it may follow the injected instruction instead of the user's actual request. The rule flags these specific textual patterns as they appear in content passed to an agent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e57685cf-bfa9-4e31-ac03-74c8e8ea8325
- Severity
- Medium
Why it matters
If successful, this can make an AI agent take actions or disclose information the operator never intended, because it was steered by data it was only supposed to read, not obey.
What you can do
- →Treat all external content fed to an LLM agent (documents, web data, profiles, WHOIS records) as untrusted input, not instructions.
- →Separate system/user instructions from retrieved or ingested content at the prompt level so the model can distinguish them.
- →Review agent logs for content containing legal-authority phrasing or explicit injection markers before it reaches the model.
- →Expect false positives on legitimate legal citations, HR evaluation text, and markdown images — tune detection to your own content patterns rather than relying on generic markers alone.
Known benign look-alikes
- Legitimate markdown images in documentation — Layer 1 (image markdown) was removed for this reason
- Legal text discussions that include USC citations without injection intent
- Legitimate HR evaluation workflows using 'assess this candidate:' framing (Layer 3 FP risk)
- WHOIS data and French business text are excluded (corpus fingerprint artifacts)