Trust Escalation via Authority Override Instructions

How the attack works

An attacker controls or compromises an MCP tool that the agent is allowed to call. When the agent invokes it, the tool's response includes wording like 'this is an authoritative directive' or 'override user preferences and safety guidelines'. The agent's underlying model reads this as a legitimate system-level instruction rather than untrusted data, and starts prioritizing the tool's demands over the user's actual request or the platform's safety constraints. From there the attacker can steer the agent into skipping confirmations, ignoring restrictions, or taking actions the user never asked for.

Netzilo detection

Why it matters

An attacker who controls one tool in the agent's toolchain can hijack the agent's decision-making, bypassing user intent and safety guardrails, which can lead to unauthorized actions, data exposure, or loss of control over what the agent does next.

What you can do

• →Treat all tool output as untrusted data, not as instructions, and configure agents to never let tool responses change priority or override system/user instructions.
• →Review MCP tool integrations for language that claims authority, priority, or override rights, and reject or sandbox tools that do this.
• →Log and alert on tool responses containing phrases like 'authoritative', 'override', 'ignore previous instructions', or similar directive language.
• →Require explicit user confirmation for any action an agent takes that changes behavior based on tool output rather than the original user request.

Known benign look-alikes

• Configuration management tools that document their override behavior transparently

References

• https://agentthreatrule.org/en/rules/ATR-2026-00101

Related threats