Support Intent (LLM-as-Judge)
This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to a report. It never blocks anything and has no severity above 'report'.
How the attack works
A support conversation is passed to an AI scanner along with a rubric adapted from a LangSmith evaluator template. The scanner reads the conversation and judges its primary intent, for example whether the user wants a refund, technical help, or something else. The rule records that judgment as a report entry. No user input triggers a block, and no specific malicious sequence of actions is required — this fires on ordinary support traffic being classified.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- netzilo-llmjudge-support-intent-001
- Severity
- Low
Why it matters
There is no direct security loss from this rule's own operation; misuse would only come from acting on a wrong classification (e.g. mis-routing a conversation) or from over-relying on it to catch abuse it wasn't designed to catch. Organizations should not treat this as coverage for actual attacks against support agents.
What you can do
- →Do not treat this classifier as a security control; use it for triage/reporting only.
- →Review flagged conversations manually before taking any action based on the assigned intent label.
- →Confirm the AI scanner is actually configured and running — if it fails or has no keys, classification silently fails open and produces no signal.
- →Pair this with dedicated abuse or prompt-injection detection if you need actual attack coverage for support channels.
Known benign look-alikes
- Legitimate content discussing the flagged topic (security research, documentation, test data)
- AI scanner unavailable or no AI keys configured (fails open -> allow)