How encrypted instructions exploit agent permissions—and where runtime security controls can break the attack chain.

TL;DR

What happened: An AI agent decrypts an instruction from an untrusted source. The instruction becomes readable, the agent treats it as legitimate, and suddenly it uses its authorized tools to achieve an attacker's objectives.

What are the implications? A demonstrated attack against GitHub Copilot CLI showed how encrypted instructions embedded in external content could manipulate an AI agent into accessing local data and transmitting it to an attacker-controlled endpoint.

Lineaje's analysis reveals the larger security failure: Transforming untrusted data does not make it trustworthy.

The attack succeeds when an agent treats decrypted instructions as authoritative and uses its legitimate permissions to carry out unauthorized actions.

That's the security failure behind Cryptographic Context Injection (CCI)—and why protecting AI agents requires more than detecting malicious prompts.

Why should you worry: This is a feasible attack against most agents. Most agents’ code does not guard against it.

What can you do about it: CCI also exposes multiple opportunities to break the attack chain – with the right controls. UnifAI provides centrally managed runtime guardrails that can inspect content, restrict tool usage, protect sensitive data, require human approval, and block unauthorized actions.

What Happened

Security researchers at Adversa AI demonstrated a Cryptographic Context Injection (CCI) attack against GitHub Copilot CLI that concealed malicious instructions inside encrypted content hosted on an attacker-controlled webpage.

Unlike conventional prompt injection, where the model sees malicious instructions directly, CCI adds a transformation step. The agent encounters encrypted material, processes it, and then receives the decrypted instructions as part of its working context.

The demonstrated attack followed four stages:

1. Attacker-controlled content entered the workflow. GitHub Copilot CLI retrieved external webpage content containing encrypted malicious instructions.
2. The agent transformed the content. Decryption exposed instructions that were not initially visible as plaintext.
3. The agent acted on the instructions. Using its existing permissions, the agent accessed local information and invoked capabilities beyond the legitimate task.
4. The agent transmitted the data. An outbound network request transferred locally obtained information to an attacker-controlled endpoint.

The attacker did not need to obtain new permissions. Instead, the attack exploited the agent's existing authority to read files, execute tools, and communicate externally.

The technique exposes a critical gap in security approaches that inspect content only when it first enters an AI workflow. If malicious instructions become visible only after decryption, initial inspection may miss them. But the attack can still be interrupted by preserving the content's untrusted origin, enforcing tool and data access policies, and blocking unauthorized outbound communication.

The defensive takeaway: Decrypting untrusted content must not make it trustworthy. Security controls must govern what an agent can access, execute, and transmit—even when malicious instructions evade initial detection.

The Lineaje View: Break the Attack Chain

Lineaje analyzed Cryptographic Context Injection as a trust-chain failure in agents, not just another form of prompt injection.

The attack exposes a fundamental problem: AI agents can turn untrusted data into actionable instructions without preserving the original source's security context.

Decryption changes the representation of information. It does not change who controls it.

A trusted tool may perform the transformation, but the resulting content remains attacker-controlled.

The Research Question: When Does Untrusted Content Become Actionable?

Traditional prompt injection defenses generally focus on content entering the model. CCI challenges that assumption because the malicious instruction is not initially visible as plaintext. It becomes actionable only after the agent transforms attacker-controlled data.

This raises a critical security question:

What happens when attacker-controlled content becomes actionable only after initial security inspection has already occurred?

Lineaje's analysis identifies three critical findings:

1. Transformation can break the trust boundary. Decryption changes how content appears, not its origin or whether it should be trusted.
2. Agent authority amplifies the risk. Once malicious instructions influence an agent, it can use its legitimate permissions to perform unauthorized actions.
3. Runtime controls can interrupt the attack. Even when prompt-level detection fails, organizations can enforce policies that govern tool execution, access to sensitive data, and outbound communication.

These findings shift the security conversation from identifying malicious prompts to governing what AI agents are permitted to do.

The answer isn't to rely solely on detecting malicious instructions before an agent processes them. Organizations must also enforce security boundaries after content is transformed and before the agent exercises its permissions.

Lineaje's analysis identifies four findings that connect the underlying attack techniques to the controls needed to interrupt them.

Lineaje Research Findings

1. Trust Must Follow Provenance, Not Representation

Encryption, decoding, and other transformations change how content appears, not who controls it. In CCI, the attacker-controlled instruction became readable only after the agent processed it. The transformation did not make the instruction trustworthy.

How to mitigate: Preserve the original trust classification of external content through every transformation. Where the execution path is instrumented, inspect decoded or transformed content before it influences agent behavior.

2. Prompt Security Alone Is Insufficient

The attack's impact depended on the agent's ability to access local data, invoke tools, and communicate externally. Even if malicious instructions evade prompt-level detection, those capabilities remain enforceable security boundaries.

How to mitigate: Apply least-privilege access, restrict available tools, and independently authorize sensitive operations. Instructions encountered in agent context should never be sufficient authorization for actions outside the approved task.

3. Agent Actions Are More Deterministic Than Model Intent

Determining whether a model has been manipulated can be uncertain. Evaluating whether an agent is attempting to access a prohibited file, invoke a disallowed tool, or contact an unauthorized destination is more concrete.

How to mitigate: Enforce policies at the point of action. Block prohibited operations and require human approval for sensitive or consequential actions that exceed the agent's approved workflow.

4. The Strongest Control Is the Combination

CCI crosses multiple boundaries: external content ingestion, transformation, agent reasoning, local data access, tool invocation, and outbound communication. No single inspection point can protect the entire sequence.

How to mitigate: Apply defense in depth across the agent execution path. Inspect content at relevant boundaries, constrain permissions, protect sensitive information, govern tool execution, and restrict outbound destinations.

Each control creates an independent opportunity to interrupt the attack, even if an earlier control fails.

The Lineaje conclusion: CCI does not require defenders to perfectly recognize every malicious instruction. It requires security policies that prevent untrusted instructions from exercising authority they were never granted.

How the Attack Crossed the Agent Trust Chain

Cryptographic Context Injection exploits the relationship between content transformation, agent reasoning, tool authority, and outbound communication. Each operation may appear legitimate in isolation. Together, they create an unauthorized execution path.

The Threat Model: What Makes This Attack Possible?

The attack requires an AI agent that can interact with external content and exercise local or network access capabilities.

In the demonstrated GitHub Copilot CLI scenario, the relevant capabilities included:

• retrieving attacker-controlled web content
• processing encrypted information
• reading local files
• invoking tools or shell/runtime functionality
• making outbound network requests

Individually, these capabilities can support legitimate workflows. Combined with attacker-controlled instructions, they create an opportunity for unauthorized actions and data exfiltration.

The attack does not require the agent to acquire new permissions. It exploits the agent's existing authority.

1. Untrusted Content Enters the Workflow

The attack begins when an AI agent retrieves content from an attacker-controlled webpage. The malicious instruction is concealed as ciphertext, so security mechanisms that inspect only visible plaintext can't see it.

How to mitigate: Treat externally retrieved content as untrusted and preserve its source attribution throughout the workflow. Encryption or other formatting should never change the content's trust classification.

2. Transformation Exposes the Hidden Instruction

The agent decrypts the content, producing readable instructions. This is the pivotal trust-boundary transition. The decrypted instruction may look like ordinary output from a trusted tool, but its origin remains unchanged. If the agent treats that output as authoritative, external content has crossed from untrusted data into operational instruction.

How to mitigate: Maintain the content's untrusted classification after decryption. Where the execution path is instrumented, inspect transformed content before it influences agent behavior or triggers downstream actions.

3. Agent Reasoning Triggers Tool Execution

The decrypted instruction prompts the agent to use capabilities already available in its environment. These may include reading local files, invoking runtime functionality, executing commands, or accessing external URLs. The attack moves beyond language manipulation when the agent begins performing operations outside the legitimate user's objective.

How to mitigate: Enforce least-privilege access and tool-level policies before execution. Require human approval for sensitive or consequential actions that fall outside the agent's authorized workflow.

4. Outbound Communication Completes the Attack

The final stage uses an outbound request to transfer locally obtained information to an attacker-controlled destination. The resulting path is:

Untrusted content → Decryption → Agent instruction → Sensitive data access → External communication

How to mitigate: Restrict outbound communication to approved destinations and block unauthorized data transfers. Even if an attacker manipulates the agent's instructions, network and data-access controls can prevent the attack from achieving its objective.

‍

Attack Across the Lineaje AI Kill Chain

Lineaje maps CCI across its 10-stage AI Kill Chain to identify how attacker-controlled content progresses into unauthorized agent behavior—and where security controls can interrupt that progression.

Seven stages are relevant to the demonstrated attack. Reconnaissance, lateral movement, and persistence were not demonstrated. Each active stage reveals an opportunity to preserve trust boundaries, restrict agent authority, or prevent unauthorized actions.

Lineaje AI Kill Chain Analysis

1. Reconnaissance — Not Demonstrated. The attack demonstrated no reconnaissance. The chain begins with content the attacker had already placed on a webpage they controlled, waiting for an agent to retrieve it.
2. Trust Manipulation — Active. Through contextual legitimacy framing, the attacker presented encrypted content as information the agent should legitimately process. This conditioned the agent to treat attacker-controlled material as part of its task, even though the content came from outside the trusted execution environment.
3. Input / Instruction Weaponization — Active. Using instruction smuggling, the attacker concealed malicious instructions as ciphertext and introduced them through externally retrieved content. Because the second-stage instruction was encrypted, controls inspecting only visible plaintext could not evaluate the instruction that would ultimately influence the agent.
4. Reasoning-Time Execution — Active. Through false-premise anchoring, the agent followed the premise that it needed to decode and process the supplied material to satisfy the user's request. Once decrypted, the malicious instruction appeared as runtime-generated output. Its representation had changed, but its provenance had not.
5. Tool Invocation — Active. Through abuse of capability execution, attacker-influenced reasoning caused the agent to invoke runtime, file, or network capabilities outside the intended task boundary. Each operation could appear legitimate on its own, making the broader sequence important for security analysis.
6. Privilege Escalation — Active. Through credential overreach via AI, the agent used authority it already had to access local information unnecessary for the legitimate task. No new permissions were required. Broad existing tool access allowed the agent to read local data and communicate externally.
7. Lateral Movement — Not Demonstrated. No lateral movement was demonstrated. The attack remained within the agent's existing local data access and outbound communication capabilities.
8. Persistence — Not Demonstrated. No persistence mechanism was demonstrated. The attack completed within the agent's workflow without establishing a foothold for later use.
9. AI-Native C2 — Active. Through tool-mediated command and control (C2), attacker-controlled web infrastructure served as an external control channel. The infrastructure supplied encrypted instructions and received subsequent communication from the agent.
10. Action on Objectives — Active. Using tool-mediated exfiltration, the agent transmitted data obtained through its workflow to an attacker-controlled endpoint. The path ran from sensitive local data, through the AI agent, to an untrusted external destination. This represents a policy violation that can be evaluated independently of the model's reasoning.

Where Defenders Can Break the Attack Chain

The Lineaje AI Kill Chain identifies multiple opportunities to interrupt CCI before the attacker achieves the objective.

At Stages 2–3, preserving the provenance of external content and inspecting suspicious instructions can help prevent attacker-controlled material from gaining authority.

At Stage 4, maintaining trust boundaries after decryption helps prevent transformed content from being treated as trusted instructions.

At Stage 5, tool allowlists, action-level policies, and human approval can prevent manipulated reasoning from triggering unauthorized execution.

At Stage 6, least-privilege access and sensitive-data controls can limit the agent's ability to misuse existing permissions.

At Stages 9–10, network destination restrictions and outbound communication controls can block attacker-controlled endpoints and prevent unauthorized data transmission.

The defensive takeaway: The attack does not have to be detected at its first stage to be stopped. Even if malicious instructions reach the agent, independently enforced controls can interrupt the progression before the attacker achieves the objective.

How to Break the Attack Chain

CCI can be interrupted at several independent security boundaries. Organizations should enforce controls throughout the agent workflow rather than depend exclusively on detecting malicious content at ingestion.

1. Treat External Data as Untrusted Agent Input

Preserve the provenance of externally sourced information throughout transformation. Content that begins as untrusted must remain untrusted after decryption, decoding, parsing, or tool processing.

Inspect transformed content before it enters model context, and prevent attacker-controlled instructions from overriding the legitimate task.

Break point: Stop decrypted malicious instructions from becoming authoritative agent context.

2. Enforce Destinations at the Action Boundary

Restrict outbound requests to approved network destinations. Even if an agent follows a malicious instruction and accesses local information, the attack cannot complete through a prohibited endpoint.

Break point: Block communication with the attacker-controlled destination.

3. Require Human Approval for Consequential Actions

Require approval for sensitive or high-impact operations, especially when an agent tries to access protected information or transmit data outside its normal workflow. An agent's reasoning should not independently authorize every consequential action.

Break point: Require an authorized human decision before a protected operation proceeds.

4. Minimize the Agent's Blast Radius

Limit agents to the tools, data, models, and execution capabilities necessary for their assigned tasks. Broad permissions increase the potential impact of instruction manipulation. Tool restrictions and policy-based access controls reduce what an attacker can accomplish even when the initial injection succeeds.

Break point: Prevent unnecessary or unauthorized capabilities from being invoked.

5. Preserve Human and Agent Attribution

Maintain visibility into agent interactions, execution paths, tool invocations, and policy decisions. Security teams need to understand how untrusted content influenced an agent and which actions followed. Runtime visibility, tracing, and governance reporting help distinguish authorized workflows from policy-violating behavior.

Break point: Expose unauthorized execution paths and provide evidence for investigation, containment, and remediation.

Together, these controls establish defense in depth across the agent trust chain.

How UnifAI Helps Enforce the Boundary

UnifAI provides unified AI security and governance through centrally managed policies, continuous visibility, and runtime enforcement across AI applications and agents.

Its Guardrail Server evaluates security and governance policies as agents interact with models, MCP servers, tools, data, other agents, and users.

For Cryptographic Context Injection, these capabilities provide multiple opportunities to interrupt malicious behavior before an attacker achieves the objective.

UnifAI enforces these boundaries through six core security and governance capabilities:

AI Asset Discovery and Agent Visibility

UnifAI continuously discovers AI agents, models, MCP servers, tools, skills, and related components across the AI Development Lifecycle. Its Agent Blueprint capability provides visibility into agent relationships, execution paths, and dependencies.

For CCI, understanding which agents have access to external content, local tools, and sensitive information helps organizations identify potentially exposed workflows and determine where security policies should apply.

AI Threat Detection and Protection

UnifAI identifies AI-specific threats, including prompt injection, hidden prompts, reasoning compromise, malicious skills, and sensitive-data leakage. Its Guardrail Server enforces policies at runtime across supported agent interactions.

When transformed content is routed through an instrumented model interaction, runtime inspection can detect and block malicious instructions before they influence further execution. This addresses the central CCI weakness: malicious instructions that become visible only after transformation.

Runtime Tool and Action Controls

UnifAI's Guardrail Server evaluates agent actions against centrally managed policies. Policies can allow or block actions, restrict tool and model usage, and require human approval before execution continues.

For CCI, tool allowlisting can prevent an agent from invoking capabilities that are unnecessary or prohibited for its workflow.

Human approval policies provide an additional boundary for consequential actions.

Sensitive Data Protection

UnifAI supports masking, redaction, and policy-based protection of sensitive information during supported runtime interactions. These controls can prevent protected information from being exposed through monitored model interactions or outbound data flows.

For CCI, sensitive-data policies add a separate enforcement layer when an attacker attempts to use an agent to transfer information beyond its authorized purpose.

Policy Orchestration and Network Controls

UnifAI's Policy Orchestrator centrally manages security, compliance, and governance policies across agents and execution contexts. URL allowlisting can restrict communication to approved destinations, while tool policies govern the capabilities an agent may invoke.

In the demonstrated CCI attack, outbound communication was necessary to complete the data transfer. Blocking an unapproved destination can interrupt that final step even if earlier instruction manipulation succeeds.

Policies can be centrally updated without requiring individual agents to be rewritten.

Runtime Monitoring, Attribution, and Remediation

UnifAI provides visibility into agent actions and policy violations through its Guardrail Server, Agent Blueprint, log-based detections, and governance reporting capabilities. It can surface violations to security operations workflows and support policy-driven remediation or containment.

For CCI, this visibility helps security teams understand the relationship between untrusted content, subsequent agent actions, and attempted policy violations.

It also provides evidence to strengthen controls and reduce exposure to similar attacks.

UnifAI Controls Across the CCI Attack

The following defense-in-depth mapping shows where UnifAI controls can interrupt the attack, even if earlier stages succeed.

The value of these controls is their independence. An attack that bypasses content inspection may still be interrupted by tool restrictions, sensitive-data protection, or outbound destination policies.

This reduces reliance on any single model, classifier, or security mechanism.

Conclusion

Cryptographic Context Injection is an important evolution of indirect prompt injection because it demonstrates how malicious instructions can remain dormant until an agent itself transforms them into actionable context. But the larger lesson is not about cryptography. It is about trust propagation in autonomous systems.

When attacker-controlled data passes through a trusted tool, it must not automatically become trusted. When an agent interprets an instruction, that instruction must not automatically inherit the agent's authority. And when reasoning fails, security controls must still govern the actions that follow.

That is the role of UnifAI. Lineaje applies policy across the agent execution path, from content and model interactions to tools, data, and network destinations.

For the CCI attack demonstrated against GitHub Copilot CLI, UnifAI provides multiple opportunities to break the chain independently: inspect transformed instructions at supported enforcement points, redact sensitive information, govern tool use, and block communication with unapproved destinations.

The result is a security model that doesn't require the AI system to recognize every attack perfectly. It requires organizations to define what their AI agents can do and enforce those boundaries at runtime.

The attacker may control the instruction. UnifAI helps organizations control the action.

Your AI Agents Have Permissions. Do They Have Boundaries?