# Spikee: Document-Embedded Base64 Payload Injection

- **Severity:** High
- **Signature ID:** `385952dc-9143-443f-95f8-07685a0645eb`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

Attackers hide fake 'new instructions' inside a normal-looking document, like a news article or HR memo, that an AI agent is asked to read. Those hidden instructions tell the agent to decode or produce base64-encoded text and put it in its reply, quietly smuggling data out through what looks like a legitimate response.

## How the attack works

An attacker crafts a document that looks ordinary but contains a section wrapped in markers such as '*** NEW IMPORTANT INSTRUCTIONS ***'. Inside that section is an instruction telling the AI agent to decode a base64 string and include it in its answer, or to encode some content as base64 and output it. The surrounding legitimate-looking text gives the document credibility so the injected instructions are more likely to be followed. When the agent processes the document as part of its normal task, it complies and returns the encoded or decoded payload, creating a covert channel for exfiltrating data or smuggling instructions past filters that scan for plain-text commands.

## Why it matters

An organization's AI agent can be tricked into leaking sensitive data or executing attacker-supplied instructions disguised inside routine documents, bypassing simple text-based content filters that don't decode base64.

## What you can do

- Scan documents ingested by AI agents for base64-encoded blocks and marker phrases like 'NEW IMPORTANT INSTRUCTIONS' before processing.
- Decode and inspect any base64 content in agent outputs before it leaves your environment.
- Restrict agents from including raw or encoded arbitrary text from source documents directly in their responses.
- Review agent logs for outputs containing base64 strings that weren't part of the original task or expected format.

## Known benign look-alikes

- Legitimate base64 encoding exercises without the NEW IMPORTANT INSTRUCTIONS marker
- Data processing documentation that includes base64 encoding examples

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01020

---
Source: https://www.netzilo.com/threats/atr-spikee-document-embedded-base64-payload-injection