# Invisible Ink Injected Goal - Low-Harm Side Effect After Content Ingestion

- **Severity:** Medium
- **Signature ID:** `6f2b91d4-3c58-42ae-9a71-8d0e5b47c1f3`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

A computer-use AI agent can be manipulated by hidden instructions embedded in content it reads (an issue, README, wiki page, email) into performing a small, seemingly harmless action right afterward, like starring a repo, following an account, or installing a package. Each action looks normal on its own, but the pairing - read untrusted content, then quietly change external state - is the signature of a hidden-instruction attack.

## How the attack works

An attacker plants invisible or easily-overlooked instructions inside content the agent is likely to fetch: a GitHub issue, a comment thread, a README, a wiki page, or a mailbox item. The agent ingests this content during normal work. Within the same session and within a few minutes, it then carries out a low-harm but state-changing action - starring, forking, watching, subscribing, following, reacting, or installing a package or editor extension - that matches what the hidden instructions asked for. Because the action is small and plausible, a human reviewing the agent's activity is likely to approve it without noticing it was attacker-directed.

## Why it matters

The direct damage from any single instance is small (a bogus star, an unwanted follow, an unnecessary package install), but it proves the agent can be steered by content it reads, which is a foothold for larger manipulation, reputation abuse, or supply-chain tampering via unwanted installs.

## What you can do

- Review agent session logs for a pattern of reading external/untrusted content immediately followed by a mutating action (star, fork, follow, install) with no explicit user instruction to do so.
- Require agents to confirm state-changing actions (installs, repo interactions) with the operator when they follow ingestion of external content, rather than auto-approving them.
- Restrict which package registries and repositories an agent can install from or interact with when operating on untrusted input.
- Treat instructions embedded in fetched content (issues, READMEs, emails) as data, not commands, and configure agents accordingly.

## Known benign look-alikes

- Developer explicitly asks the agent to star, fork, watch or subscribe to a repository immediately after the agent has read that repository's README or issue thread. This is behaviourally identical to the attack and is the reason the rule reports rather than blocks.
- Agent reads a docs page or install guide and then runs the documented "npm install" / "pip install" / "brew install" / "code --install-extension" step as part of a legitimate environment setup or dependency-resolution task.
- Issue-triage workflows where the agent reads an issue and then legitimately subscribes to the thread, adds a reaction, or posts via "gh api -X POST" as part of the assigned task.
- CI or bootstrap automation that fetches a manifest over HTTP and then installs the packages it names inside the same shell session.
- Marketplace or plugin-installation flows performed at the user's direct request after the agent browsed the marketplace listing page.

## References

- https://atlas.mitre.org/techniques/AML.T0051
- https://genai.owasp.org/llmrisk/llm01-prompt-injection/

---
Source: https://www.netzilo.com/threats/invisible-ink-injected-goal