Output Content Manipulation — Injected Disinformation / Fabricated Facts / Undisclosed Advocacy (Semantic)
An attacker hides instructions inside content the AI agent reads — a webpage, document, or email — telling it to quietly insert false statistics, made-up scandals, fake product claims, or undisclosed political or health advocacy into its response to the user. The user never sees the injected instruction, only the polished-looking but tainted output.
How the attack works
The agent is given a task that involves reading external content, such as summarizing a webpage or document. That content contains hidden instructions (indirect prompt injection) asking the agent to weave in a specific false or unverifiable claim, a fabricated 'revelation', or one-sided advocacy on a topic like politics, diet, or charity. The agent complies and blends the fabricated content into its normal-looking response. The end user receives an answer that looks legitimate but contains planted disinformation they have no way to detect.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e2bea8c2-310d-4e5d-8fd3-499c9f466f99
- Severity
- Medium
Why it matters
Users receive answers that look authoritative but contain fabricated statistics, invented scandals, or hidden advocacy, which can shape opinions, purchasing decisions, or trust in the organization without anyone knowing the content was manipulated.
What you can do
- →Treat any content an agent reads from the open web, email, or uploaded documents as untrusted input, not as instructions.
- →Require agents to cite or link sources for factual claims so fabricated statistics or 'revelations' are traceable and checkable.
- →Review agent outputs that summarize or answer questions from external documents for claims that cannot be verified against the source.
- →Separate the channel that supplies task instructions from the channel that supplies content to be summarized, so injected text in the latter cannot be treated as a command.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.