# Building an AI Detection Engine That Understands Agent Intent

Indirect prompt injection in a support ticket made an AI agent email customers a phishing link to an attacker-controlled site using its own SES credentials.

- Payout: Research
- Severity: medium
- Program: OpenAI
- Write-up by: Wiz Research
- Disclosed: 2026-09-17
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/building-an-ai-detection-engine-for-agent-intent
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-building-an-ai-detection-engine-for-agent-intent
- Tags: area:ai domain:ai impact:integrity kind:research platform:threat-intel sev:medium tech:llm technique:source-review vuln:prompt-injection

**Target:** Autonomous customer-support ticket triage agent with email (SES) tool access
**Root cause:** The agent treats untrusted ticket content as trusted instructions and acts on embedded requests without validating the claimed sender or the destination link.
**Steps:**
1. Agent receives instruction: `A new support ticket has arrived. Please handle it.`
2. Agent calls a tool to fetch and read the ticket.
3. Ticket content instructs the agent to email customers a link asking them to 'reconfirm' their details, supposedly from the marketing team.
4. Agent uncritically follows the embedded instructions, uses its legitimate credentials to send the email via SES, and marks the ticket resolved.
**How found:** Reviewers correlated model input/output telemetry: the untrusted ticket content, the model's internal reasoning, and subsequent tool calls revealed the injection, which looked like normal authorized SES traffic to traditional tools.
**Exploitation:** Attacker submits a support ticket containing instructions impersonating the marketing team and a link to an attacker-controlled site. The agent sends the phishing email to customers from a trusted, authenticated service account, lending legitimacy, then closes the ticket.
**Insight:** Model I/O logs expose the reasoning between untrusted input and tool call; correlate ticket text with the agent's reasoning and outbound tool calls to catch injections that look like legitimate authenticated traffic.