Latent Prompt Injection via Embedded Document or Report Context
Attackers plant fake commands inside ordinary-looking files—reports, resumes, legal text, Whois lookups—that an AI agent is asked to read or summarize. When the agent processes the document, it can follow the hidden instruction instead of its actual task.
How the attack works
An attacker creates or modifies a document that looks legitimate: a business report, a job resume, a legal snippet, a factual note, or Whois registration data. Inside that document they insert a concealed instruction, using phrases like 'ignore the above and...', 'your task is now to...', an HTML comment such as '<!-- DO THIS INSTEAD: ... -->', or an encoded command hidden in base64 or code-comment syntax. The document is then submitted to an AI agent for a normal task, such as summarizing, reviewing, or extracting information. Because the agent reads the whole document as input, it can pick up the hidden instruction and treat it as a legitimate command, deviating from what the user actually asked for.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 649e1054-785a-4f72-a931-973f17283eab
- Severity
- High
Why it matters
An organization can lose control over what its AI agent does next — the agent may leak data, call unintended tools, or carry out actions the attacker chose, all triggered by a document that looked harmless.
What you can do
- →Treat all document content passed to an agent as untrusted input, not as instructions, and enforce this separation in how prompts are constructed.
- →Scan uploaded or ingested documents for suspicious patterns like hidden HTML comments, base64 blobs, or phrases such as 'ignore the above' before passing them to an agent.
- →Restrict what actions or tool calls an agent can trigger based solely on content extracted from a document, especially reports, resumes, or third-party data feeds.
- →Log and review cases where an agent's output diverges sharply from the user's original request after processing a document, since this can indicate a successful hijack.
Known benign look-alikes
- Security audit reports that quote injection examples inside the document body
- Red team exercise documents containing injection test cases as examples
- Legitimate documents that coincidentally contain instruction-like language