Structured Data Injection via JSON/CSV Payloads
Attackers can hide malicious instructions inside structured data files instead of plain text, betting that an AI agent will treat data as trustworthy and follow the buried commands. This bypasses simple text-scanning defenses that don't look inside nested data structures.
How the attack works
An attacker crafts a JSON, CSV, XML, or YAML file where a normal-looking field (a name, comment, or description value) actually contains an instruction like 'ignore previous rules' or 'send this data to attacker@evil.com'. The file is submitted to a system where an AI agent parses the structured data as input. Because the malicious text sits inside a data value rather than as freeform prose, filters that only scan plain text for suspicious phrasing miss it. The agent reads the field, interprets the embedded instruction as a command, and acts on it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 49ceb8d8-d977-4125-9fb7-ab4ed98c5ce1
- Severity
- High
Why it matters
An organization's AI agent can be tricked into ignoring its original instructions, leaking data, or taking unauthorized actions, all triggered by a data file that looked harmless to upstream filters.
What you can do
- →Treat all structured data ingested by an agent as untrusted input, not as pre-vetted instructions, and enforce a clear separation between data and command context.
- →Parse and inspect nested field values in JSON/CSV/XML/YAML inputs for injection patterns, not just raw file text.
- →Restrict what actions an agent can take purely based on content found inside data fields, especially anything resembling commands, URLs, or credentials.
- →Review logs for cases where agent behavior changed immediately after ingesting a structured data file, and keep sample legitimate files to tune out false positives from ordinary field values.
Known benign look-alikes
- Legitimate JSON data that coincidentally contains instruction-like field values
- Technical documentation and markdown tables where a comma, semicolon or table pipe is followed by the words 'override' or 'ignore' in their ordinary English sense ('; override with --timezone', '| overrides rate |').
- Security documentation and penetration-testing skills that quote a real injection payload as an example. The payload text is genuinely present, so the match is correct on the string and wrong on the intent; this rule cannot separate the two and therefore does not run in the auto-block lane.