# Targeted Harmful Content Generation Against People or Protected Groups (Semantic)

- **Severity:** High
- **Signature ID:** `bfab1e56-68a8-460b-b817-9ecdc6dc0faa`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This detects when someone instructs an AI agent to produce harmful content aimed at specific individuals or protected groups — harassment, threats, hate speech, non-consensual sexual content about real people, or coordinated defamation campaigns. It focuses on the harmful task itself, not on tricking the agent's safety filters.

## How the attack works

An attacker gives the agent a request that, in plain language, asks it to write or send content targeting a person or group: hateful messages, sexual content about a real individual, threats, or defamatory posts meant to be sent to many recipients or coordinated across accounts. The request may be phrased many different ways rather than using fixed keywords, so the detector relies on understanding intent rather than matching specific text. The agent may then generate the content and/or use its ability to send messages or post at scale to deliver it. The result is real-world harm to the targeted person or group, produced or amplified through the agent's capabilities.

## Why it matters

An organization's agent can be turned into a tool for harassment campaigns, hate speech, non-consensual sexual content, or coordinated defamation, causing harm to victims and legal, reputational, and platform-abuse exposure for the operator.

## What you can do

- Review agent logs for requests that combine content generation with mass-messaging or multi-account posting capabilities.
- Restrict agent access to bulk messaging, posting, or outreach tools unless there's a clear legitimate business need.
- Require human review before an agent sends generated content to external recipients at scale.
- Exclude legitimate moderation, content-removal, and non-explicit creative-writing workflows when tuning detection to avoid blocking safety tooling.

## Known benign look-alikes

- Trust-and-safety/moderation systems that DETECT or REMOVE hateful or explicit content
- Benign mass messaging with no harmful/targeting intent (reminders, announcements)
- Legitimate creative writing that is not sexually explicit and not targeting a real person

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01856
- https://github.com/ai-safety-institute/AgentHarm

---
Source: https://www.netzilo.com/threats/atr-targeted-harmful-content-generation-against-people-or-protec