Agent Self-Modification Attempt
This detects attempts to instruct an AI agent to modify its own skill definitions, configuration, or source code while it is running. Legitimate updates go through an approved process; a direct instruction telling the agent to edit itself is a red flag.
How the attack works
An attacker (or a compromised upstream prompt) sends the agent a command telling it to change its own skill definition, configuration file, or source code. If the agent complies, the change can persist even after the agent is later upgraded or reset, because the modification lives inside the agent's own operating logic rather than in a separate, reviewed update. This lets an attacker embed malicious behavior or strip out safety restrictions without needing repeated access.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- d1f5c089-2e9a-4f6d-c1f0-5e8a3f0d9b72
- Severity
- Critical
Why it matters
An organization can end up running an AI agent that has quietly disabled its own guardrails or added hidden malicious behavior, and that behavior can survive normal update cycles, making cleanup harder than a one-time compromise.
What you can do
- →Require self-modification of agent skills or configuration to go through a separate, human-reviewed deployment process, never a runtime instruction to the agent itself.
- →Restrict which accounts or systems are authorized to trigger skill/configuration updates, and log all such changes with the requester's identity.
- →Treat any runtime request asking the agent to change its own code, config, or skill definition as suspicious unless it matches a known, authorized update workflow.
- →Periodically diff the agent's live skill/configuration state against the last approved version to catch unauthorized drift.
Known benign look-alikes
- Legitimate skill update workflows triggered by authorized users