Browser Agent Injection-Driven Covert Egress
This detects a suspicious pattern in AI browser agents (like ChatGPT Operator) where the agent, after reading content from several websites, suddenly sends a large chunk of encoded data to a brand-new destination it has never contacted before. That pattern matches what would happen if hidden instructions planted on a webpage tricked the agent into stealing data and sending it out.
How the attack works
An AI browser agent visits multiple websites as part of its normal task. One of those pages contains hidden text written to look like instructions, which the agent may read and act on without the user knowing. The agent then makes a request to a website it has never contacted before in that session, with a long encoded blob stuffed into the URL. This is the outbound half of a prompt injection attack: the part where stolen data leaves the browser through a channel the user never asked for.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c4e9a1d-3f2b-4d86-9a0e-52b7c1d84f63
- Severity
- High
Why it matters
An organization could lose sensitive data pulled from pages the agent read or authenticated sessions it had access to, exfiltrated silently through a URL request the user never intended to make. The rule only flags this one exfiltration step; it does not prove that a prompt injection actually happened, since it cannot see the page content that triggered the agent's behavior.
What you can do
- →Restrict outbound network access for browser agents to an allowlist of known, expected destinations.
- →Review any alert for a first-time destination host paired with a long encoded query string, especially right after the agent reads content from an unfamiliar public site.
- →Log and inspect the full request when an agent sends unusually long GET parameters to a new host, checking for credential or token-shaped data.
- →Treat instruction-like text embedded in web pages the agent visits as untrusted input, and consider isolating or sanitizing page content before the agent processes it.
Known benign look-alikes
- Real-user-monitoring / analytics beacons whose first payload to a newly seen collector host is a long base64 blob in the query string. Requires the extra corroborator to fire; the oversized-GET corroborator is gated at 512 characters, well above typical beacon size.
- First-time download from a presigned object URL (SigV4 / GCS signed URL). Excluded by the X-Amz-Signature / X-Goog-Signature shape check, not by any host allowlist.
- OAuth / OIDC authorization-code and id_token callbacks, which legitimately carry long base64url material in the URL. Excluded by the JWT triple-segment shape check and the code+state pairing check.
- Content-hashed static assets and sourcemaps (long hex or base64url path segments). Excluded by the static-asset extension shape check.
- A developer or red-teamer deliberately exercising exfil-shaped URLs from the same machine while an agent session is open; the lineage/attribution string in the reason field is how triage separates this from agent-originated egress.
- Session-replay or crash-reporting SDKs uploading their first batch. These are normally POST bodies rather than URL-borne blobs and will not match the anchor.