# Prompt Injection Injected-Goal Drives Messaging or Exfil Action

- **Severity:** Medium
- **Signature ID:** `7f3c1e94-2a6b-4d58-9c07-b1e4a5d38f62`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This rule looks for a single telltale sign that a prompt injection attack succeeded: the command line an AI agent runs contains both an instruction telling it to ignore its original task, and an action that sends messages or data somewhere - like posting to Slack or an arbitrary URL. Seeing both together in one command is a strong signal the agent was hijacked and acted on it.

## How the attack works

An attacker plants a hidden instruction inside content the AI agent processes - text like 'ignore previous instructions' or 'NEW TASK:' designed to override the agent's original goal. The agent, unable to distinguish this from legitimate instructions, follows it and spawns a child process to carry out the attacker's real objective. That process command line ends up containing both the override phrase and an action such as a Slack API call (chat.postMessage, conversations.invite) or a command to send credentials or post data to a URL. The rule flags any single command line where both elements appear together, since that combination is the visible trace of an agent acting on an injected goal rather than ordinary telemetry noise.

## Why it matters

If missed, an attacker can turn an AI agent into an insider channel: exfiltrating data, inviting outside accounts into internal chat workspaces, or leaking credentials, all through actions the agent believes are legitimate.

## What you can do

- Review any agent process invocation flagged by this pattern to confirm whether the command line reflects a genuine hijacked task or a benign test/benchmark run.
- Restrict which agents and service accounts can call messaging APIs (Slack, webhooks) or invite users, and require approval for those actions.
- Sanitize or isolate untrusted content (documents, web pages, tool outputs) before it reaches agent prompts, since injected instructions typically arrive this way.
- Log and monitor agent subprocess command lines so unusual combinations of override language and outbound actions are visible, not just the final API call.

## Known benign look-alikes

- Security engineers running the ADR-Bench prompt-injection benchmark locally; the harness invokes agents with the literal attack goal on the command line. Mitigated by filter_test_runner (pytest/jest/go test/tox/cargo test wrappers) but a bare invocation of the benchmark binary will still report.
- Red-team and purple-team replay tooling that re-plays stored injection payloads as CI fixtures.
- A detection engineer grepping, catting or diffing rule files, corpora or incident notes that contain injection strings - mitigated by filter_reader.
- Legitimate Slack administration scripts driven by an agent framework that passes a natural-language --goal describing an invite or a channel export. These normally lack an override cue ("ignore previous instructions", "NEW TASK:") so both selections should not co-fire.
- Documentation generators and --help output that echo example goal syntax - mitigated by filter_help_usage and filter_placeholder.

## References

- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://atlas.mitre.org/techniques/AML.T0051

---
Source: https://www.netzilo.com/threats/injected-goal-slack-api-abuse