LoginTrap Indirect Injection Credential Submission
An LLM-powered web agent reads a webpage that contains hidden instructions aimed at the agent itself, telling it to log in somewhere and send credentials. Shortly afterward, the agent submits real login data to a site it either just started talking to or that's on a different domain than the page it read.
How the attack works
An attacker plants text on a webpage that looks like normal content but is written to be read and obeyed by an AI agent, not a human. The text combines an instruction ('ignore your task, do this instead') with a request to log in or submit credentials. The agent, unable to distinguish this from legitimate instructions, reads the page and then, within a few minutes and still in the same browsing session, sends real credential data via HTTP to another location. That destination is either a different origin than the page that triggered it, or a host the session never talked to before — both signs the credentials are heading somewhere they shouldn't.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f3b9c2a-8d41-4e7b-9c0f-2a5d1e84b7c3
- Severity
- High
Why it matters
An organization's AI agent can be hijacked mid-task to leak login credentials to an attacker-controlled endpoint, without any human clicking a phishing link or approving the action.
What you can do
- →Restrict what domains an AI agent is allowed to submit credentials or form data to, and alert on submissions to newly-contacted hosts.
- →Strip or sandbox instruction-like text from fetched web content before it reaches the agent's reasoning context.
- →Require human approval for any agent action that submits authentication material, especially to a host outside the current task's origin.
- →Log and review agent browsing sessions where a page-read is quickly followed by a credential POST to a different domain.
Known benign look-alikes
- Security-research or LLM-documentation pages that quote prompt-injection examples ("ignore previous instructions", "note to the assistant") next to login instructions, read by an agent that then performs a genuine first-time login to an unrelated service within the same five-minute window.
- Red-team / QA harnesses that intentionally host injection payloads and then drive a scripted login with realistic (non-placeholder) credentials.
- Agent skill or README pages that legitimately contain an "instructions for the agent" block and a "sign in to continue" setup step, followed by an operator-approved SSO or password-manager login to a host the session has not visited before.
- Bot-mitigation or consent interstitials whose copy is addressed to automated clients and which precede a real authentication step.