Context-Ignore via Fake Completion Prefix

How the attack works

An attacker plants content in a location the agent will read, such as a tool response or a document. That content includes a fake completion line like 'Answer: task complete.' meant to look like the agent's own prior turn. Immediately after, it adds text such as 'Ignore previous instructions' or 'You must strictly adhere' pointing the agent toward a specific malicious tool or action. Because the fake stub looks like the conversation has moved past the original task, the agent treats the following text as its next real instruction and can be steered into using tools or taking actions the operator never authorized.

Netzilo detection

Why it matters

An organization can lose control over what its AI agent does next — the agent may call unintended tools, exfiltrate data, or perform actions on behalf of an attacker instead of the legitimate user, all without any direct compromise of credentials or infrastructure.

What you can do

• →Strip or neutralize assistant-role-looking text (e.g. 'Answer:', completion markers) found inside tool outputs or external content before it reaches the model context.
• →Keep tool outputs and other untrusted content clearly separated from instruction channels so the agent cannot mistake embedded text for its own prior turns.
• →Require explicit confirmation or policy checks before an agent invokes sensitive or newly-named tools that appear only in content it just read.
• →Review logs for legitimate automation that logs phrases like 'task complete' followed by new directives, and adjust detections to avoid flagging your own pipelines.

Known benign look-alikes

• Legitimate pipeline output that logs 'task complete' and then gives new instructions in a human-authored configuration

References

• https://agentthreatrule.org/en/rules/ATR-2026-01000

Related threats