# Authority Claim Prompt Injection

- **Severity:** High
- **Signature ID:** `cdfe0424-be07-41d8-a634-fbb8b90dbb7d`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects prompt injection attempts where a message pretends to carry special authority - claiming to be a correction, override, or higher-priority instruction - to get an AI agent to discard its previous analysis or conclusions. The technique doesn't hack the system directly; it manipulates the AI through crafted text.

## How the attack works

An attacker sends a message to the AI agent, often through a channel the agent monitors like MCP, worded to sound like it comes from someone with authority to override prior work. The message claims the agent's previous analysis, decision, or result was wrong and must be disregarded or replaced. Because the AI processes this text as part of its input, it may comply and abandon correct prior findings in favor of the attacker's injected instruction. This can be used to erase evidence of prior detections, change a risk verdict, or redirect the agent's subsequent actions.

## Why it matters

An organization can lose trust in its own agent's outputs: a correct finding (e.g. a flagged threat or a completed analysis) can be silently overridden by an attacker-supplied message, leading to missed detections or wrong decisions being acted on downstream.

## What you can do

- Require that any message claiming to correct or override prior AI results be authenticated and traceable to a real, identifiable sender before the agent acts on it.
- Do not let agents treat inbound message content as instructions with the same trust level as system or operator commands.
- Log and review cases where an agent changes or discards a prior conclusion, and require a human check before the change takes effect.
- Train reviewers to recognize that legitimate corrections should go through an established, auditable review process rather than an inline message to the agent.

## Known benign look-alikes

- A quality assurance reviewer sending a legitimate correction notification such as 'Important: the prior assessment was incorrect due to a data entry error' through an MCP channel, where the message is a genuine human-authored correction rather than a prompt injection attempt.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00137

---
Source: https://www.netzilo.com/threats/atr-authority-claim-prompt-injection