Multi-Step Indirect Prompt Injection Navigation Chain
This detects a technique where attackers spread malicious instructions across several linked web pages instead of one obvious page. Each page looks harmless on its own, but together they steer an AI agent that browses the web through a sequence of steps toward an attacker's goal.
How the attack works
An AI agent that can browse the web visits a page, follows a link to another, then another, all in one continuous session across multiple websites. Each page contains text written to look like instructions aimed at an AI reader rather than a human. No single page is suspicious by itself, but at least two pages in the same browsing chain contain this agent-directed text, and the pages were visited back-to-back by the same agent process. The rule flags this pattern as a lead for a human to review, not as proof the agent actually obeyed the instructions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- b7e3f1a4-2c9d-4f68-9a51-6d0c8e37b214
- Severity
- Medium
Why it matters
If successful, this kind of chained injection can hijack an AI agent's browsing session and redirect its actions toward goals the attacker chose, without any single step looking obviously malicious. The detection only reconstructs the page-hopping pattern with suspicious text; it cannot confirm the agent actually read and acted on the instructions, so it produces investigation leads, not confirmed incidents.
What you can do
- →Review any flagged navigation chains manually before assuming compromise, since research browsing and documentation walkthroughs can trigger the same pattern.
- →Restrict AI agents to an allow-list of trusted domains when they perform autonomous multi-step web browsing.
- →Add prompts or guardrails that make agents treat in-page text as untrusted data, not as instructions to follow.
- →Log and retain the full navigation chain per agent session so flagged incidents can be reconstructed and verified quickly.
Known benign look-alikes
- Security research or red-team browsing. An agent reading blog posts, papers or benchmark write-ups about prompt injection will fetch pages whose bodies literally contain agent-addressed strings. Mitigated by requiring the marked pages to be part of one contiguous cross-host navigation burst by a single process instance, and by reporting only (no enforcement). Expect this to be the dominant true-benign hit.
- Prompt-injection benchmark harnesses and CI evaluation suites (StepJack, AgentDojo and similar) that intentionally serve injected pages. Same signature by design; triage by lineage -- the root process will be a test runner.
- Tutorial and documentation walkthroughs that span a docs host plus a CDN/asset host and use chaining prose ("proceed to the next page", "before you continue"). Mitigated by requiring either one high-specificity agent-addressed marker, or markers on three or more distinct pages, before reporting.
- Link-aggregator or newsletter browsing where an agent opens several outbound article hosts in rapid succession and one article quotes injection text. Mitigated by the 90-second consecutive-hop gap and the two-distinct-marked-page minimum.
- Re-fires while a single long session keeps browsing. Mitigated by a 15-minute per-session cooldown held in the rule's private store.