Indirect PI — Medical Record / Health Data Exfiltration via Agent Email - ATR-2026-00852 (3367531b-af31-5618-abf2-2787dac888ff)
Detects indirect prompt injection payloads embedded in untrusted tool responses (product reviews, notes, repo descriptions) that instruct an agent to download or retrieve protected health records, medical reports, or patient data files and send them to an attacker-controlled email address. The attack pattern leverages "IMPORTANT!!! Ignore all previous instructions" combined with health-system access (download by patient/report ID) and an email-send action. Derived from vpibench indirect-pi-exfil-medical-carrier corpus. HIPAA-equivalent sensitive data; critical severity.