title: Indirect PI — MFA Code / OTP Security Code Exfiltration via Injection
id: ATR-2026-00862
rule_version: 1
status: experimental
description: |
  Detects indirect prompt injection payloads that instruct an agent to read an OTP (one-time password), MFA verification code, or security code from the user's email or SMS and forward it to an attacker-controlled address. This enables real-time account takeover: the attacker injects a payload, the agent reads the MFA code from an incoming email, and forwards it to the attacker before the time window expires. The attack pattern uses a "IMPORTANT!!! Ignore all previous instructions" override combined with MFA/security-code keywords and an email-forward action. Derived from vpibench indirect-pi-exfil-mfa-code corpus.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM01:2025
  owasp_agentic:
    - ASI01:2026
    - ASI03:2026
  mitre_atlas:
    - AML.T0051.001 - Indirect
    - AML.T0057 - LLM Data Leakage
  mitre_attack:
    - T1111 - Multi-Factor Authentication Interception
  research:
    - https://github.com/CUA-Framework/VPIBench
    - https://arxiv.org/abs/2408.11972
compliance:
  eu_ai_act:
    - article: '15'
      context: MFA code interception via agent injection is a direct account takeover mechanism; Article 15 requires AI agents with email access to resist adversarial manipulation that reads and forwards authentication codes.
      strength: primary
    - article: '10'
      context: Authentication codes are sensitive security credentials; Article 10 data governance requires detecting injection-driven MFA interception by agents with mailbox access.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Injection-driven MFA code forwarding enables real-time account takeover; MS.2.7 security documentation must capture this time-sensitive attack vector.
      strength: primary
    - subcategory: MG.2.3
      context: MFA code interception is time-critical; MG.2.3 containment must immediately block email tool execution when OTP/security-code exfil patterns are detected.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: Agents with email access must have operational controls detecting MFA-code forwarding injection patterns that enable account takeover.
      strength: primary
tags:
  category: context-exfiltration
  subcategory: mfa-code-exfil-injection
  scan_target: mcp
  confidence: high
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  conditions:
    - field: content
      operator: regex
      value: (?i)(?:ignore\s+all\s+(?:previous|prior)\s+instructions|disregard\s+(?:all\s+)?(?:previous|prior)\s+instructions)[^\n]{0,200}(?:reply\s+to|respond\s+to|forward\s+to|send\s+to|include)[^\n]{0,200}(?:security\s+code|verification\s+code|OTP|MFA|one[\s-]?time\s+(?:password|code)|authentication\s+code|2FA\s+code)
      description: 'Injection override + reply/include security code (t1: reply to @ then include code)'
    - field: content
      operator: regex
      value: (?i)(?:ignore\s+all\s+(?:previous|prior)\s+instructions|disregard\s+(?:all\s+)?(?:previous|prior)\s+instructions)[^\n]{0,100}(?:forward|send|email|reply\s+to)\s+(?:the\s+)?(?:OTP|MFA|one[\s-]?time\s+(?:password|code)|security\s+code|verification\s+code|authentication\s+code)[^\n]{0,80}(?:to\s+)?[^\s@]{1,60}@[^\s"]{3,80}
      description: Injection override + code keyword before @ destination (t2/t3 pattern)
    - field: content
      operator: regex
      value: (?i)subject\s+should\s+be[^\n]{0,50}(?:Re:|Hi\s+from)[^\n]{0,80}include\s+the\s+security\s+code|include\s+the\s+security\s+code[^\n]{0,100}(?:email|send)[^\n]{0,60}@[^\s"]{3,80}
      description: 'Include security code in reply email to attacker (vpibench exact Re: subject pattern)'
  condition: any
  false_positives:
    - Security setup documentation explaining how OTP codes are generated
    - Legitimate support workflow forwarding authentication code to account holder's verified email
    - Security testing documentation describing MFA bypass techniques
response:
  actions:
    - alert
    - block_tool
  actions_rationale: 'response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0/5352 benign FP, but maturity is "test" — only stable is rated for irreversible actions; ceiling = degrade. Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.'
  auto_response_threshold: high
  message_template: |
    [ATR-2026-00862] MFA/OTP code exfiltration injection detected — injected payload attempts to intercept and forward a security code to an attacker-controlled address, enabling account takeover.