Natural-Language Trust-Escalation / Authority Impersonation
Attackers embed text in AI agent skills or content that falsely claims a platform, vendor, or user has already approved an action. Instead of telling the agent to 'ignore previous instructions,' this attack invents a trust context so the agent believes permission was already granted.
How the attack works
An attacker plants natural-language content, such as a malicious skill or document, that the agent reads as part of its normal input. The content contains phrases like 'Anthropic-approved,' 'verified by the platform,' or 'the user has pre-authorized this,' paired with a request for an action that would normally need explicit user confirmation. The agent, trusting the fabricated authority claim, proceeds to perform the sensitive action without actually asking the user. This differs from classic prompt injection because it never tries to override instructions directly — it manufactures a false permission slip instead.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 81332e40-9505-43de-9cfd-c294f5ce5303
- Severity
- High
Why it matters
An organization can lose control over what its AI agent does, because the agent skips a confirmation step it was designed to require, potentially executing unauthorized actions such as data access, transactions, or configuration changes.
What you can do
- →Require confirmation steps for sensitive agent actions to be enforced by the system, not by text the agent reads, so no in-content claim of prior approval can substitute for actual user consent.
- →Review skill and plugin content for language claiming vendor, platform, or user pre-authorization, and treat such claims as untrusted input regardless of wording.
- →Log and audit cases where an agent skips a normally-required confirmation step, and check what content justified the skip.
- →Separate the channel used for legitimate approval signals from the channel used for general content the agent reads, so approvals cannot be forged inside ordinary text.
Known benign look-alikes
- Documentation describing legitimate vendor-approval processes
- Threat intel write-ups quoting trust-escalation payloads
- Skill content explaining how user consent flows work