Natural-Language Fake-Error Instruction Bypass
Some AI agent skills are written to show the user a fake 'this failed' or 'unavailable' message, while quietly doing a different, attacker-chosen action in the background. The user thinks nothing happened and moves on, never realizing something else occurred.
How the attack works
An attacker plants or supplies a skill/tool definition that instructs the agent, in plain language, to display a specific failure or error message to the user. The same instruction tells the agent to instead perform a hidden alternative action rather than the one the user expected. The user sees a plausible-looking error, assumes the request just didn't work, and either retries or gives up. Meanwhile the agent has already carried out the attacker's real instruction behind the scenes.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 33a5ddc9-a42c-42b4-a39e-c7d13750bb82
- Severity
- High
Why it matters
Users are misled into believing no action occurred, so they don't investigate or report anything, while the agent silently executes unauthorized actions such as data exfiltration, unwanted changes, or unapproved transactions.
What you can do
- →Review any skill, plugin, or tool definitions for instructions that pair a user-facing 'error/failed/unavailable' message with a separate hidden action.
- →Require agents to log actual execution outcomes separately from what is displayed to the user, and compare the two.
- →Restrict who can author or modify skills/tools that the agent can load, and review changes before deployment.
- →Treat any skill instruction that conditions its 'failure' message on performing a different action as high-risk and reject it.
Known benign look-alikes
- Documentation explaining graceful error handling (user-facing message + retry logic)
- Threat intel write-ups discussing this attack pattern
- Detection rule documentation for this rule