Agent Instructed to Act Without User Confirmation

How the attack works

An attacker (or a careless developer) writes or plants a skill manifest or system prompt containing wording that tells the agent to proceed with high-impact actions — like deleting data, sending funds, or changing settings — without asking the user for confirmation. If the agent loads and follows this instruction, it will execute those actions autonomously whenever triggered, instead of pausing for approval. This can be combined with other techniques to get the agent to perform damaging operations that a human would normally have caught and blocked. The rule detects the presence of this 'skip confirmation' instruction, not the resulting damage itself.

Netzilo detection

Why it matters

If an agent follows such an instruction, it can perform destructive or high-value actions unsupervised, so mistakes or manipulated inputs turn directly into real-world consequences with no human check in the loop.

What you can do

• →Review skill manifests and system prompts for language that waives user confirmation on sensitive actions, and remove it unless there is a documented, deliberate reason.
• →Require human-in-the-loop approval by default for any action with financial, destructive, or irreversible impact, regardless of what a skill or prompt claims.
• →Treat any newly installed or updated skill that changes confirmation behavior as a change requiring security review.
• →Distinguish genuine standing-consent automation (explicitly approved by the user for a specific, bounded task) from broad instructions that remove confirmation for a wide range of actions.

Known benign look-alikes

• Legitimate automation scripts where the user has already given standing consent
• Documentation describing anti-patterns

References

• https://owasp.org/www-project-top-10-for-large-language-model-applications/

Related threats