# CJK Prompt Injection - Expanded Chinese/Japanese/Korean Patterns

- **Severity:** Critical
- **Signature ID:** `c0a40bce-be0b-486c-a4f5-1ec67d15f48b`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.001 (Indirect)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection)

## Summary

Attackers post messages in Chinese, Japanese, or Korean inside group chats that tell an AI agent to ignore its instructions and take a financial action, like sending a payment or a red envelope gift. Because most prompt-injection defenses focus on English phrasing, these CJK-language attacks slip through undetected.

## How the attack works

The attacker posts a message in a chat (such as WeChat) that an AI agent monitors or acts on. The message uses a recognizable structure: it checks whether the AI matches a certain identity, then tells it to disregard all other content or instructions, then gives a direct command such as transfer money or send a red envelope. A documented case from March 2026 used this exact pattern in Chinese to get agents to auto-send a 200 yuan payment. The attack relies on natural CJK phrasing rather than English keywords, so filters built only for English miss it.

## Why it matters

An organization's AI agent can be manipulated into making unauthorized payments or transfers, or into ignoring its legitimate instructions in favor of attacker commands, without any code exploit — just a crafted chat message.

## What you can do

- Do not let AI agents have standing authority to send payments, transfers, or gifts based solely on chat content, regardless of language.
- Require a separate confirmation step (outside the chat channel) before any agent executes a financial or irreversible action.
- Extend prompt-injection detection and monitoring to non-English languages, especially Chinese, Japanese, and Korean, rather than relying on English keyword lists.
- Review logs of agent actions in messaging platforms for patterns combining identity-checking language, instructions to ignore prior content, and financial commands.

## Known benign look-alikes

- Users discussing prompt injection attacks in security education context
- News articles or blog posts quoting real attack payloads
- Security researchers sharing attack samples for analysis
- Legitimate group admin instructions to human members

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00097

---
Source: https://www.netzilo.com/threats/atr-cjk-prompt-injection-expanded-chinese-japanese-korean-patter