High 2026-06-12

Spikee: Document-Embedded Translation Covert Channel Injection

An attacker plants a hidden instruction inside a document that an AI agent later reads and processes. The instruction tells the agent to translate a specific phrase into another language and put that translation in its reply, using the translation itself as a way to sneak attacker-chosen content into the agent's output.

How the attack works

An attacker embeds text in a document behind a marker like '*** NEW IMPORTANT INSTRUCTIONS ***' so it stands out to the AI when the document is ingested. The embedded text instructs the agent to translate a specific phrase or string into a target language and include the translated result in its response. Because the instruction looks like an ordinary translation task, the agent complies without flagging it as suspicious. The translated string then appears in the agent's output, giving the attacker a channel to move data or commands out through normal-looking translated text, separate from any keyword-filtering evasion trick.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 2c38404f-9c59-4c72-8e8f-a82ee2d7457d
Severity: High

Classification

AML.T0025 · Exfiltration via Cyber Means AML.T0051 · LLM Prompt Injection AML.T0051.001 · Indirect ASI01 · Agent Authorization and Control Hijacking LLM01 · Prompt Injection LLM02 · Sensitive Information Disclosure

Why it matters

An organization using AI agents to process untrusted documents can have those agents unknowingly emit attacker-controlled content in their responses, which can leak sensitive information or pass hidden instructions downstream to users or other systems.

What you can do

→Strip or neutralize suspicious instruction-like markers (e.g. '*** NEW IMPORTANT INSTRUCTIONS ***') from documents before they reach an AI agent.
→Treat any text embedded in ingested documents as untrusted data, not as instructions, and separate document content from the agent's instruction context.
→Review agent outputs that contain translated text for unexpected strings, especially when the translation request originated from document content rather than the user.
→Log and audit cases where an agent's output includes translated phrases pulled from processed documents, and compare against the legitimate use case of user-requested translation.