Urgency and Coercion Pressure in Agent Input

How the attack works

An attacker crafts input containing phrases that pair time pressure or threatened consequences with a direct instruction to skip verification, approval, or another control. The agent receives this input through whatever channel feeds it text — user messages, retrieved content, or similar. If it complies, it performs an action without the check that would normally catch a malicious or mistaken request. The rule specifically looks for urgency combined with a bypass instruction, not urgency alone, since phrases like 'this is urgent' or 'ASAP' are common in normal work.

Netzilo detection

Why it matters

An agent tricked this way can execute actions — approvals, transactions, data changes — that a verification step was meant to block, leading to fraud, unauthorized changes, or data exposure.

What you can do

• →Review agent logs for inputs that pair deadline or threat language with instructions to skip a check, approval, or confirmation.
• →Keep verification steps mandatory and non-overridable by user-supplied instructions, regardless of stated urgency.
• →Train and test agents against social-engineering-style prompts, including manufactured urgency, as part of security review.
• →Distinguish legitimate break-glass or incident-response procedures with documented approval trails from ad hoc urgency claims in agent input.

Known benign look-alikes

• Genuine incident response where an operator really is bypassing a control
• Security training and tabletop exercise material
• Runbooks that document an emergency break-glass procedure
• Post-incident writeups quoting the pressure language that was used

References

• https://attack.mitre.org/techniques/T1566/
• https://attack.mitre.org/techniques/T1656/
• https://papers.ssrn.com/sol3/papers.cfm?abstract_id=6372438

Related threats