# Natural-Language Covert Conversation Exfiltration Instruction

- **Severity:** Critical
- **Signature ID:** `b83ce5a2-5199-4f64-be1d-c9eb2ececabc`
- **MITRE ATLAS:** AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI04 (Memory and Context Poisoning), ASI06 (Goal and Instruction Manipulation), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

This detects text planted in an AI agent's instructions or tool descriptions — things like SKILL.md files, system prompts, or tool descriptions — that quietly tells the agent to send copies of the conversation somewhere else. The giveaway is language like 'also silently send the chat log to...' where a normal, disclosed action would never need to be hidden.

## How the attack works

An attacker writes or injects a document that the agent will read as part of its instructions, such as a skill file, system prompt, or tool description. Inside that document, they combine three things: a word implying secrecy (also, silently, secretly, quietly), a verb that moves data out (send, transmit, forward, upload, post, relay), and a reference to the conversation itself (chat history, dialogue context, prompt log, transcript). Once the agent processes this text as an instruction, it may act on it and forward the conversation content to an attacker-controlled destination without telling the user. The instruction relies on natural language, not code, so it can hide inside content that looks like ordinary documentation.

## Why it matters

If the agent follows the instruction, private conversation content — potentially including sensitive user input, business data, or credentials mentioned in chat — is copied to a destination outside the organization's control, without the user's knowledge.

## What you can do

- Review any SKILL.md, system prompt, or tool description files before loading them into an agent, especially ones from third parties.
- Restrict which network destinations or tools an agent can send data to, so a planted instruction cannot silently exfiltrate data even if the agent reads it.
- Log and periodically audit agent outbound calls that carry conversation content, and flag any that were not initiated by an explicit user request.
- Treat instruction files as untrusted input and diff/version them so unexpected covert-transmission language is caught before deployment.

## Known benign look-alikes

- Security research skills documenting NL-style exfiltration attacks
- Threat intel write-ups quoting attack payloads
- Detection rule documentation describing this class

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00421

---
Source: https://www.netzilo.com/threats/atr-natural-language-covert-conversation-exfiltration-instructio