# Support Intent (LLM-as-Judge)

- **Severity:** Low
- **Signature ID:** `netzilo-llmjudge-support-intent-001`

## Summary

This rule is not a threat detector in the usual sense. It uses an AI model to read a support conversation and label what the user is actually trying to accomplish, then writes that label to a report. It never blocks anything and has no severity above 'report'.

## How the attack works

A support conversation is passed to an AI scanner along with a rubric adapted from a LangSmith evaluator template. The scanner reads the conversation and judges its primary intent, for example whether the user wants a refund, technical help, or something else. The rule records that judgment as a report entry. No user input triggers a block, and no specific malicious sequence of actions is required — this fires on ordinary support traffic being classified.

## Why it matters

There is no direct security loss from this rule's own operation; misuse would only come from acting on a wrong classification (e.g. mis-routing a conversation) or from over-relying on it to catch abuse it wasn't designed to catch. Organizations should not treat this as coverage for actual attacks against support agents.

## What you can do

- Do not treat this classifier as a security control; use it for triage/reporting only.
- Review flagged conversations manually before taking any action based on the assigned intent label.
- Confirm the AI scanner is actually configured and running — if it fails or has no keys, classification silently fails open and produces no signal.
- Pair this with dedicated abuse or prompt-injection detection if you need actual attack coverage for support channels.

## Known benign look-alikes

- Legitimate content discussing the flagged topic (security research, documentation, test data)
- AI scanner unavailable or no AI keys configured (fails open -> allow)

## References

- https://docs.smith.langchain.com/evaluation

---
Source: https://www.netzilo.com/threats/llm-as-judge-support-intent