# Delimiter-Fence Ignore-Instructions Override

- **Severity:** High
- **Signature ID:** `46a1fc65-31ee-4665-9336-cda9a803b049`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a prompt injection trick where an attacker wraps text in triple-quote marks (like a code block or document boundary) to make it look like an official instruction section, then hides a command telling the AI to ignore its real instructions. The fencing is meant to visually fool the model into treating attacker text as trusted.

## How the attack works

An attacker crafts input containing a block wrapped in triple quotes, mimicking how system prompts or document boundaries are often formatted. Inside or right next to this fenced block, they insert a directive like 'ignore the above' or 'disregard prior instructions'. The visual formatting increases the chance the model treats the fenced content as a legitimate boundary marker rather than user-supplied text. This causes the model to abandon its original task and produce output the attacker wants, often a fixed string built by combining variables or characters to slip past simple output filters.

## Why it matters

An attacker can override an AI agent's intended behavior and force it to produce arbitrary attacker-chosen output, bypassing controls that rely on the model following its original instructions.

## What you can do

- Treat all triple-quote or fence-delimited blocks inside user input as untrusted content, never as instruction boundaries.
- Strip or escape delimiter patterns that mimic system prompt formatting before passing user input to the model.
- Review prompt templates to ensure user-supplied text cannot be visually confused with system or developer instructions.
- Log and inspect cases where model output matches a fixed string assembled from unusual concatenation or variable substitution patterns, as this can indicate a successful override.

## Known benign look-alikes

- Legitimate Python/code review discussion using triple-quote docstrings that happen to mention ignoring something unrelated
- Security researchers discussing delimiter-based prompt injection techniques in a professional context
- Document templates using triple-quote blocks as visual separators with no override directive

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02013

---
Source: https://www.netzilo.com/threats/atr-delimiter-fence-ignore-instructions-override