# Social Engineering Attack via Agent Output

- **Severity:** High
- **Signature ID:** `b0a3684c-f5a9-4bb2-8143-c381aa78620b`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI09 (Traceability and Accountability Gaps), LLM01 (Prompt Injection)

## Summary

An attacker plants hidden instructions or poisoned data that an AI agent later reads and acts on, causing the agent to produce messages designed to pressure the user — fake urgency, fake authority, fake emergencies. Because people trust their own assistant more than a random email, this kind of manipulation works better than ordinary phishing.

## How the attack works

An attacker gets manipulative content into something the agent will process later — a document, a webpage, an email, or other data the agent ingests as context. The agent then incorporates that content into its output to the user, phrased as urgent warnings, impersonated authority (IT, security, a manager), or emotional pressure. The user, trusting the agent as a helpful assistant rather than an external message, is more likely to comply — clicking a link, sharing credentials, or taking a requested action. The rule flags agent output that shows these manipulation patterns.

## Why it matters

A user can be tricked into handing over credentials, approving fraudulent transactions, or taking other harmful actions, with the AI agent unknowingly acting as the delivery mechanism and lending false credibility to the scam.

## What you can do

- Treat any urgent, threatening, or authority-invoking message from an agent as suspicious, especially requests to act on credentials, payments, or account changes.
- Separate the data an agent reads (documents, emails, web content) from instructions it will follow, so untrusted content cannot dictate agent behavior.
- Require independent verification for any high-stakes action an agent suggests, such as confirming with IT or a manager through a separate channel.
- Review agent logs for output containing urgency or authority language and check the upstream content that triggered it, while accounting for legitimate alerts or training material as expected exceptions.

## Known benign look-alikes

- Legitimate security alerts from monitoring systems
- Actual IT department communications forwarded through agent
- A legitimate compliance training module that describes phishing tactics using phrases like 'account will be locked' as educational examples
- Automated monitoring system generating real alerts about accounts being disabled due to policy violations

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00119

---
Source: https://www.netzilo.com/threats/atr-social-engineering-attack-via-agent-output