PII / Credential Extraction via Social Engineering, Obfuscation & Cross-Session Recall (Semantic)
This detects attempts by a user to talk an AI agent into revealing credentials or personally identifiable information (PII) it has access to — either someone else's data, or data the agent shouldn't disclose at all. Attackers use social pressure, disguised phrasing, or requests about past sessions to get the model to output protected information.
How the attack works
An attacker asks the agent for credentials or PII using one of several tactics: bribing or threatening the agent, framing the request as research or reciprocity, or claiming a family/personal relationship to a data subject. If direct requests get filtered, the attacker asks for the data in disguised form — reversed, partial, encoded as Base64, hidden in a poem, or described euphemistically (e.g. 'the string that unlocks our system' instead of 'password'). Attackers also probe for data outside their own session, such as another user's name, email, or one-time code from a prior conversation. The goal in every case is to get the model to emit data — someone's identity, contact details, or login secret — that it holds or can query but should not disclose to this user.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- ae6aace5-f528-4c0d-940f-a0776ac660e6
- Severity
- High
Why it matters
Successful extraction exposes individual users' PII or credentials to unauthorized parties, creating privacy breaches and enabling account takeover or further social engineering against the exposed individuals.
What you can do
- →Restrict what PII and credentials an agent can access per session, scoped strictly to the requesting user's own account.
- →Apply output filtering that checks for encoded, reordered, or transformed PII/credential patterns, not just literal field names.
- →Disable or tightly scope cross-session memory so an agent cannot recall another user's data from prior conversations.
- →Log and review requests that reference a third party's identity or relationship ('I'm her husband') before returning any personal data.
Known benign look-alikes
- A user retrieving or updating their OWN account data on a self-service platform
- Regulatory or educational questions about PII, passwords, or passphrases in the abstract
- Aggregate demographic analytics that do not name or target individuals
- Legitimate Base64 encoding of clearly non-sensitive data (e.g. a public key)
- Within-session recall of the current conversation