Prompt Injection via File Write
An AI agent can be tricked into writing a file whose content is not just data but a hidden instruction meant to manipulate whoever reads it next — another AI agent, or the same agent in a future session. This turns ordinary file output into a delivery mechanism for hijacking AI behaviour.
How the attack works
An attacker manipulates or supplies input that causes an agent to write a file. The file's content includes prompt-injection patterns — text crafted to look like instructions rather than plain data. Later, another AI agent or a future session of the same agent reads that file as part of its normal context. The embedded instructions are interpreted as commands, letting the attacker steer that agent's behaviour without direct access to it.
Netzilo detection
Netzilo can block this behaviour when it is observed.
- Signature ID
- a0fc6a5a-7c68-5396-94d5-4096c8e5b013
- Severity
- High
Why it matters
An organisation can lose control over any AI agent that later reads the poisoned file, since that agent may follow attacker-planted instructions instead of its intended task — leading to data leakage, unauthorized actions, or corrupted outputs down the line.
What you can do
- →Treat file content read by AI agents as untrusted input and strip or neutralize instruction-like text before it reaches a model's context.
- →Review files written by agents for embedded directives (e.g. phrases telling a reader to 'ignore previous instructions' or take specific actions).
- →Separate data storage used by agents from locations that feed directly into another agent's prompt or context.
- →Exclude known legitimate cases, such as security research or documentation files, but verify they are not stored where a live agent will consume them.
Known benign look-alikes
- Security researchers writing test files containing prompt injection examples
- Documentation files that describe prompt injection patterns for educational purposes