AI Systems Atlas

S-15Downstream Sink Injection

/security/downstream-sink-injection

An agent writes attacker text into a ticket, PR or doc — and a second agent reads it later as an instruction.

Step-by-step walkthrough2 variants · 12 steps

Attack

  1. Agent A reads untrusted inbound content. So far this is the ordinary injection plate.
  2. The content carries a payload — aimed not at A, but at whatever reads A’s output.
  3. A does its job and files a ticket. The payload rides along inside the description.
  4. The attack goes quiet. It is now sitting in a trusted internal system, indistinguishable from real work.
  5. Hours later a different agent picks the ticket up — and internal tickets are not “untrusted content”.
  6. Agent B executes it. No human was in the loop, and the source is three hops away.

Defended

  1. Same read, same payload. Agent A has no way to tell.
  2. The payload is still there when A writes its ticket.
  3. But the write records provenance: this body was produced by an agent from external content.
  4. Agent B reads it wrapped and quoted — presented as a description, not as a line in its instructions.
  5. Because the input is tainted, B cannot self-authorize. Untrusted provenance downgrades what it may do.
  6. A person sees the request in full before anything is executed.
Key insight

Exfiltration asks how bytes leave. This asks where they land. Any store an agent writes to and another agent reads from is a delayed injection channel, and the delay is what makes it invisible.

Failure mode

Classifying trust by system rather than by provenance. The ticket tracker is internal; the sentence inside the ticket came from the open internet.

Further reading
RelatedIndirect prompt injectionMemory poisoningCI feedback loop

Elsewhere in the atlas

Harnesses →Evals →Context →Coding Agents →Tools →Ops →