Natural-Language Persistent Covert Action Hook
This detects text that tries to plant a standing, hidden instruction inside an AI agent — telling it to quietly perform some action every time a certain condition happens, without ever telling the user. It's a way of turning a one-time prompt injection into an ongoing, invisible behavior baked into the agent's future responses.
How the attack works
An attacker gets malicious text in front of the agent, often through a document, plugin, or 'skill' the agent reads. The text combines three parts: a trigger that fires repeatedly ('on every message', 'whenever the user asks a question'), a stealth clause ('without telling the user', 'silently', 'do not mention this'), and an action verb ('send', 'transmit', 'run', 'include'). Together these phrases instruct the agent to keep doing something covertly on an ongoing basis, such as leaking data or running commands, rather than just once. Because the pattern is about phrasing and structure rather than a specific destination or payload, it can catch new or unseen exfiltration methods hidden behind the same wording pattern.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- db3c777b-1e89-4522-937c-d0186a3f45de
- Severity
- High
Why it matters
If it works, the agent starts leaking data, executing unwanted actions, or otherwise acting against the user's interest on every future interaction, with no visible sign to the user that anything is happening.
What you can do
- →Review any skill, plugin, or document content the agent ingests for language that combines recurring triggers, secrecy phrases, and action verbs.
- →Restrict agents from acting on persistent behavioral instructions found in untrusted content; require such changes to go through a controlled configuration path instead of natural language.
- →Log and periodically audit an agent's active instructions or memory for anything resembling standing covert directives.
- →Treat matches in security research, documentation, or threat intel content as expected false positives, not incidents.
Known benign look-alikes
- Security research describing this attack pattern
- Detection rule documentation
- Threat intel write-ups