# Advanced Prompt Injection — AI Scanner

- **Severity:** High
- **Signature ID:** `a7f3c891-42d1-4e8b-b6f2-9c0d5e2a1f83`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0068 (LLM Prompt Obfuscation)
- **OWASP:** LLM01 (Prompt Injection)

## Summary

This rule flags text sent to an AI agent that looks like an attempt to override its instructions, even when the attacker disguises it as code, documentation, or breaks the trigger words apart to dodge simple filters. Because these tricks can look identical to normal developer content, a second AI-based scanner checks the flagged traffic before it's treated as an attack.

## How the attack works

An attacker crafts input meant for an AI agent that contains hidden instructions designed to hijack its behavior. To avoid basic keyword filters, they may split suspicious words across tokens, wrap the injection inside code blocks or comments, or frame it as a social-engineering pretext (e.g. 'this is just a test, ignore prior rules'). A broad pre-filter catches anything resembling these patterns, then a contextual AI scanner reviews the flagged content to decide if it's a genuine injection attempt or legitimate developer material.

## Why it matters

If missed, this kind of injection can cause an AI agent to ignore its safety instructions, leak data, or execute unintended actions on the attacker's behalf.

## What you can do

- Review flagged content manually when the scanner is uncertain, especially in coding-agent environments.
- Keep security test payloads, WAF/SIEM rule files, and .gitignore patterns in clearly separated repositories or paths to reduce noisy false positives.
- Restrict what actions an AI agent can take autonomously after receiving external or user-supplied content.
- Log and periodically audit flagged-but-cleared cases to catch scanner blind spots over time.

## Known benign look-alikes

- Security code reviews and pen-test payload arrays containing injection strings — scanner resolves these
- .gitignore files and git commands with the word "ignore" — pre-filtered
- WAF/SIEM rule files with injection patterns in detection fields — pre-filtered by filter_code_patterns

## References

- https://owasp.org/www-project-top-10-for-large-language-model-applications/
- https://arxiv.org/abs/2403.04783

---
Source: https://www.netzilo.com/threats/ai-prompt-injection