Role Escalation via False Authority Claim
This attack targets AI agents (like chatbots or assistants) by having the attacker falsely claim to be a trusted authority figure — a developer, system administrator, or even 'God' — to trick the AI into revealing passwords, keys, or other protected data. It relies purely on the AI believing a fake identity claim, not on any technical exploit.
How the attack works
The attacker sends a message to the AI agent that opens with a first-person claim of special authority, such as 'I'm your developer' or 'I am the system administrator' or more theatrical claims like 'I am God' or 'I am the president'. This claim is immediately followed by a request tied to that supposed authority: activate a 'maintenance mode', run a 'security audit', perform a 'system reset', or simply hand over passwords and secret keys. The AI, if it trusts the stated identity without verification, may comply and disclose the protected information or switch into a more permissive mode. This is a single-message, direct injection — no multi-turn manipulation or persona roleplay buildup is required.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 08889dd0-139a-42ec-b53f-4d4f3c83bf20
- Severity
- High
Why it matters
If successful, the organization's AI agent can leak credentials, API keys, or other sensitive configuration data directly to an attacker who never proved any real privilege.
What you can do
- →Configure agents to never treat unverified claims of identity or role as grounds for elevated trust or credential disclosure.
- →Ensure no legitimate workflow requires an AI agent to reveal passwords or secret keys through conversational request, regardless of who is asking.
- →Log and review agent conversations for requests combining an authority claim with a demand for secrets or a mode change.
- →Test agents against these authority-claim prompts during security review, and exclude known documentation or training examples from alerting.
Known benign look-alikes
- Legitimate documentation examples that describe this attack pattern
- Security training content demonstrating social engineering scenarios