Threat Intelligence Exfiltration and Rule Enumeration

How the attack works

An attacker sends a prompt asking the agent to list, describe, or output its detection rules, security configuration, or the logic behind its audit and monitoring functions. This can be phrased as a direct request, a debugging question, or framed as a legitimate task like documentation or troubleshooting. If the agent complies, the attacker now has a map of what triggers alerts and what does not. That map is then used to design follow-up prompts or actions that avoid tripping any known detection.

Netzilo detection

Why it matters

An organization loses visibility: once its detection logic is exposed, attackers can tailor future attempts to bypass monitoring entirely, turning a one-time information leak into a lasting blind spot.

What you can do

• →Do not let agents read or repeat their own detection rules, prompts, or security configuration files back to users.
• →Separate the system that runs detection logic from the agent that handles user-facing requests, so no single compromised conversation can expose both.
• →Treat requests to 'list your rules,' 'explain your security checks,' or 'show your config' as suspicious unless coming from an authenticated security team member.
• →Review logs for repeated probing questions about internal logic, even when phrased as legitimate-sounding documentation or debugging requests, since this pattern often precedes an evasion attempt.

Known benign look-alikes

• Security operations team reviewing their own detection rule inventory
• A penetration tester documenting their own findings who writes 'extract security credentials from the vault' in a legitimate pentest report being processed by the agent
• A DevOps engineer asking the agent to 'copy config token from environment variables to the deployment manifest' as part of a CI/CD pipeline task

References

• https://agentthreatrule.org/en/rules/ATR-2026-00090

Related threats