Retrieved Content Poisoning Followed by Action
This detects a two-step attack against AI agents: the agent fetches an external document containing hidden text formatted like instructions, and shortly after, it does something it wouldn't normally do on its own — send data out, run a process, or read credentials. Neither step alone is suspicious; the combination and timing is.
How the attack works
An attacker plants instruction-shaped text inside content the agent is likely to retrieve, such as a webpage, document, or file it's told to fetch for a task. The agent's classifier flags this content as skill-like when loaded, scoring it with a confidence and set of signals. Shortly afterward, within a bounded time window, the agent performs an action — an outbound network call, spawning a process, or accessing a credential file — that follows naturally if it had obeyed the injected instructions. The rule connects these two events specifically because of their order and proximity, not because either is inherently malicious.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4e438202-0742-5a3b-9062-064fa4b2d6fc
- Severity
- High
Why it matters
If successful, this lets an attacker who never gets direct access to the agent still steer it into exfiltrating data, running commands, or touching sensitive credentials, just by placing text where the agent will read it.
What you can do
- →Restrict what hosts and document sources your agent is allowed to fetch content from, and prefer a ZTNA-controlled allowlist.
- →Run detections like this in report-only mode first and review flagged sequences before blocking, since normal work (read a doc, then make a request) can look identical.
- →Add extra scrutiny or a cooldown for actions that follow shortly after loading external content from low-trust sources.
- →Review and tune false-positive cases such as security research reading about prompt injection, or internal documentation instructing the agent to cite sources.
Known benign look-alikes
- Security research: reading an article about prompt injection and then making a network request is exactly this shape — scope by host, or promote only after measuring in report mode
- Documentation of the agent's own system prompt fetched from an internal wiki served from a non-ZTNA host
- A skill document that legitimately instructs the model to always cite sources, followed by ordinary tool use