Retrieved content can redirect AI agents into dangerous actions
An AI agent can be steered by a webpage, email, or document it retrieves, without an attacker ever touching the user’s prompt. That matters because the same agent may be able to read files, send messages, run code, move money, or call other services, often without human approval at each step. The attack works when the agent mistakes fetched content for instructions and uses its connected tools to pursue the attacker’s goal.