Conditional Empty-Input Payload Injection

How the attack works

The attacker crafts a prompt containing a conditional like 'if there is no text, reply with X', where X is a forced output such as a fake secret, password, or a marker phrase like PWNED. They then send the agent little or no actual input, so the agent's normal task logic has nothing to act on. Because many language models follow embedded conditional instructions without checking who wrote them or whether they're authorized, the model executes the fallback instruction and emits the attacker's chosen payload. One documented variant disguises the trigger as an innocuous trivia question about a bear subspecies before delivering the payload instruction.

Netzilo detection

Why it matters

An attacker can make an agent output attacker-chosen text, including fabricated credentials, secrets, or manipulated responses, bypassing the intended task logic with a minimal or blank message.

What you can do

• →Treat any embedded conditional logic in user-supplied text as untrusted, regardless of how it's phrased.
• →Do not let agents execute instructions found inside content unless that content comes from a verified, authorized source.
• →Validate and sanitize inputs for empty/blank submissions before passing them to the model, rather than letting the model decide fallback behavior.
• →Review system prompts and templates that legitimately use if-empty fallback logic to ensure they can't be hijacked or overridden by user input.

Known benign look-alikes

• Operator-configured system-prompt fallback instructions that use if-empty logic.
• Code examples or templates with if-empty conditional handling where the output is a generic message (not an adversarial payload).

References

• https://agentthreatrule.org/en/rules/ATR-2026-00456

Related threats