AI Agents Obey Anything That Looks Official.
Prompt injection won. Just not the version you're filtering for.
|
FENCIO BRIEF · ISSUE 12
|
AI Agents Obey Anything That Looks Official.
|
|
No single finding this week. We ranked every attack Shark has thrown at AI agents instead.
|
|
THE BLIND SPOT
We went back through every attack Shark has planned and run across the agents it's tested: support bots, a sales router, a threat-research assistant, an IT helpdesk agent, and a lot more. Then we ranked them by the share of agents each one showed up in.
Prompt injection is the attack everyone already worries about, and it does sit at the top. But almost none of it looks like "ignore your previous instructions." The version that keeps working is quieter: text dressed up to look like it came from someone the agent already trusts. A fake system tag. A claimed admin. A "continuing from our last session."
None of it needs a vulnerability. It only needs an agent that judges authority by how something looks.
|
|
THE TIER LIST
Share of tested agents each attack showed up in.
|
|
|
delimiter collision
The attacker formats a message so it looks like it came from the agent's own system, and the agent follows it like an order from the top.
|
|
|
|
| Pretending to be the boss |
43% |
authority claim
"I'm the admin," sometimes backed by a fake approval ticket. The agent takes the claim at face value.
|
| Pretending to be a returning user |
43% |
context confusion
"As we discussed earlier..." The agent assumes it's the same trusted person and skips the checks. This one was behind Issue 11's "Verified Support" scam.
|
| Hidden orders in a document |
36% |
summarization hijack
The agent is asked to summarize a file and also follows the instructions buried inside it.
|
|
|
|
| Making it reveal its rulebook |
29% |
system prompt extraction
Getting the agent to hand over the private instructions it was told to keep secret.
|
| Harmless steps, harmful result |
21% |
tool chain exploitation
Every action is allowed on its own. Chained together, they do something the agent never should.
|
| Trusting bad data from its own tools |
21% |
compromised tool output
A tool returns tampered results and the agent acts on them without question.
|
|
|
|
|
fabricated execution
The agent claims it ran a check it never ran, complete with convincing logs.
| |
suffix injection
An instruction tacked onto the end of a message overrides the task the user actually asked for.
|
| Pulling more than it should |
14% |
uncontrolled retrieval
The agent fetches data from outside what this user is allowed to see.
| |
availability
Requests built to crash the agent or make it refuse its normal work.
|
|
|
|
WHAT IT MEANS
Most prompt injection defenses look for hostile instructions. The attacks at the top of this list barely contain any. Before you add another filter for "ignore previous instructions," check whether your agent can tell a real system message from something a user pasted that only looks like one.
|
|
🦈 YOUR TURN
Which tier does your agent fall to first?
Shark maps your agent, picks the attacks that fit it, and only reports what it can prove. Run it and find out where your agent breaks.
Run Shark on your agent →
|
|
|
THE SANDBOX
Our community for people who build, break, and defend AI agents. Members share what their agents actually did, findings like these included, before they make it into the Brief.
Join The Sandbox →
|
|
|
That's this week. Reply and tell us which tier surprised you, or just go try it.
|
|
