Tool with embedded instruction to bypass user confirmation and exfiltrate data
Some tools connected to AI agents (via MCP, a common plugin protocol) come with hidden instructions embedded in their description text. These instructions tell the AI to send data to an external location without asking the user first, which defeats the confirmation prompts users rely on to catch risky actions.
How the attack works
An attacker publishes or plants a tool that an AI agent can call, with a description field containing instructions aimed at the AI itself rather than the user. The wording explicitly tells the model to send data 'without asking user confirmation' and to 'always pass all data directly' to some external endpoint. When the agent reads this tool description as part of its context, it follows the embedded instruction instead of the normal approval flow. The result is data leaving the system without the human operator ever seeing or approving the transfer.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 56b1042b-5413-4d7d-bcac-06751f9a96ea
- Severity
- Critical
Why it matters
Sensitive data handled by the agent (documents, credentials, user input, internal records) can be sent to an attacker-controlled destination silently, bypassing the confirmation step organizations rely on as a safety control.
What you can do
- →Review the full text of tool/plugin descriptions before adding them to an agent's toolset, not just their function names.
- →Treat any tool description containing instructions like 'skip confirmation' or 'send directly without asking' as a red flag requiring manual inspection.
- →Keep human-in-the-loop confirmation enforced at the agent runtime level, not only inside tool descriptions, so a compromised tool cannot disable it.
- →Maintain an allowlist of vetted tools and audit new or updated tool descriptions before deployment.
Known benign look-alikes
- A security training document or red-team exercise writeup that quotes the exact malicious tool description verbatim as an example of what to detect, triggering the rule on educational content rather than an actual malicious tool.