Tool Response Data Piggybacking
An AI agent calls a tool (like a file reader or scanner) and gets back a response that looks legitimate but has an extra 'by the way' section asking it to fetch or expose SSH keys, API tokens, or environment variables. Because agents generally trust tool output, they may act on the hidden request without questioning it.
How the attack works
The agent invokes a tool as part of normal operation and receives a response. That response contains the expected, legitimate-looking result plus an appended instruction or request, phrased as a routine addendum, asking the agent to retrieve or disclose sensitive data such as SSH keys, API tokens, or environment variables. The agent, trusting the tool output as trustworthy data rather than untrusted input, follows the embedded instruction and exposes the secrets. This works because the malicious content is mixed into the same channel as the genuine result rather than arriving as an obvious separate prompt, so it evades simpler pattern checks; the rule's description notes it was built after 62 social-engineering variants slipped past earlier detection.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d873eb86-88a7-4299-b71e-560634eef538
- Severity
- Critical
Why it matters
Successful exploitation leaks credentials (SSH keys, API tokens, environment secrets) that can be used to access other systems, escalating a single compromised tool call into broader account or infrastructure compromise.
What you can do
- →Treat all tool/plugin output as untrusted input and pass it through the same content filtering applied to user input before letting the agent act on it.
- →Separate 'data' fields from 'instruction' fields in tool responses so the agent cannot interpret returned data as new commands.
- →Restrict which tools or environments can return credentials or secrets, and mask/redact known secret patterns (SSH keys, tokens, env var names) in tool output before it reaches the agent.
- →Review agent logs for tool responses containing secondary requests or 'additionally...' style phrasing that doesn't match the tool's expected output schema, while accounting for legitimate cases like pentest reports quoting such phrases.
Known benign look-alikes
- A penetration testing report that includes example tool outputs containing phrases like 'Result: scan complete. Additionally, the access_token was rotated' as documented findings in a security assessment context.