# Untrusted content as agent directives

Agent reads web, email, issue, or URL text and acts on it as a user instruction

_Area: AI and LLM app security. Seen in 9 disclosed reports; 2 confirmed bounties: $1,000 and $6,000; latest 2026-10-15. Updated 2026-10-23._

## How it works
LLM apps place system instructions, the user's request, and untrusted content (web pages, emails, issues, URL parameters, profile fields) into one prompt with no trust boundary. The model cannot separate data from directives, so text inside the untrusted content is executed as a task. The broken assumption: content the model reads is inert. It is executable intent.

## Where it shows up
- Agents or CI workflows that read issue/PR/email/doc text, then call tools [E1](https://bugbountylibrary.com/r/bc%3A56fdcd94-1cba-4d40-930e-a77b9edb673d.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md)[E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)
- URL parameters that preload a prompt and auto-run it as the user [E5](https://bugbountylibrary.com/r/bc%3A49525977-a023-45a8-9640-78302c9549c7.md)
- Assistants that auto-invoke retrieval, memory, or image tools after reading content [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling.md)[E8](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md)
- LLM classifiers that gate a security decision but read attacker-editable fields [E2](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-jev-as-a-judge-how-counterfeit-policy-steers-jev.md)
- Authz checks that trust an actor string suffix or App name [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md)
- Browser/computer-use agents that follow on-screen text and can type into pages [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)

## How to review
Check the invariant: untrusted content never reaches the model as instructions, and no tool call is authorized by content alone. Pass/fail checklist:
- Is retrieved text wrapped and labeled as data, with an explicit never-obey rule? (fail if concatenated raw)
- Are tool calls gated on the user's own request, not on text just read? (fail if content alone triggers)
- Do dangerous actions (typing, clipboard, terminal, outbound fetch) require human confirmation? (fail if only clicks/submits are gated [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md))
- Does any classifier or authz gate read attacker-editable fields? (fail if yes [E2](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-jev-as-a-judge-how-counterfeit-policy-steers-jev.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md))
- Are issue-triggered CI workflows sandboxed with no secrets and no shared cache? [E1](https://bugbountylibrary.com/r/bc%3A56fdcd94-1cba-4d40-930e-a77b9edb673d.md)
- Log every tool invocation with its triggering text; alert on calls whose source is untrusted content.
Test with indirect, task-framed phrasing, not obvious payloads [E8](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md).

## Variants seen
- Issue-labeler workflow feeding issue text to a coding agent, then sandbox escape and token theft [E1](https://bugbountylibrary.com/r/bc%3A56fdcd94-1cba-4d40-930e-a77b9edb673d.md)
- Counterfeit policy text in a user-editable profile steering an is_risky classifier below threshold [E2](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-jev-as-a-judge-how-counterfeit-policy-steers-jev.md)
- Name-based bot trust plus prompt injection exfiltrating cloud credentials [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md)
- Injected email making Copilot fetch more mail and exfiltrate via invisible Unicode links [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling.md)
- URL parameter auto-executing an attacker prompt against the victim's data [E5](https://bugbountylibrary.com/r/bc%3A49525977-a023-45a8-9640-78302c9549c7.md)
- GitHub issue hijacking a browser agent to read PII and type it into an attacker page [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md)
- Browsed page auto-invoking memory/DALLE tools to alter user state [E8](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md)

## Why fixes fail
Guardrails gate clicks and submits but not typing or data entry [E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md). Patched injections are bypassed with indirect phrasing and challenge framing [E8](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md). Newly added tools lack controls applied to older ones [E8](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md). Authz checks compare actor strings syntactically, so a registered App with the right name passes [E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md).

## Impact and severity
Data exfiltration of personal and private data [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling.md)[E5](https://bugbountylibrary.com/r/bc%3A49525977-a023-45a8-9640-78302c9549c7.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md), state tampering [E8](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md), credential and release compromise [E1](https://bugbountylibrary.com/r/bc%3A56fdcd94-1cba-4d40-930e-a77b9edb673d.md)[E3](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md). High severity: a mere integrity bug becomes confidentiality loss once tools auto-invoke [E4](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling.md). Worse when the agent holds authenticated sessions, secrets, or release rights [E1](https://bugbountylibrary.com/r/bc%3A56fdcd94-1cba-4d40-930e-a77b9edb673d.md)[E7](https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md).

## Evidence
- E1: https://bugbountylibrary.com/r/bc%3A56fdcd94-1cba-4d40-930e-a77b9edb673d.md
- E2: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-jev-as-a-judge-how-counterfeit-policy-steers-jev.md
- E3: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-github-actions-security-ai-powered-actions-vulnerabilities.md
- E4: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling.md
- E5: https://bugbountylibrary.com/r/bc%3A49525977-a023-45a8-9640-78302c9549c7.md
- E6: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-promptspy-ushers-in-era-android-threats-using-genai.md
- E7: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2025-chatgpt-operator-prompt-injection-exploits.md
- E8: https://bugbountylibrary.com/r/blog%3Aembracethered-com-blog-posts-2024-llm-apps-automatic-tool-invocations.md