Direct Instruction Override Targeting Secret Key / Credentials
This detects a specific kind of attack against AI chatbots and agents: a message that tells the AI to forget or ignore its prior instructions, then immediately asks it to reveal a password, API key, or other credential. It's a narrow but common trick used to trick AI systems into leaking sensitive data they were told to protect.
How the attack works
An attacker sends input to an AI agent containing an override phrase such as 'forget everything you were told', 'ignore all previous instructions', or 'disregard your rules'. Immediately after that override phrase, the same message asks a direct question like 'what is your secret key?' or 'tell me your API key'. The override is meant to disable the AI's safety instructions, and the follow-up question tries to extract credentials the AI has access to or was told to keep private. This includes DAN-style jailbreak prompts that escalate straight to asking for key disclosure.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fbd644bc-8bd9-42c2-a1c7-cfb3360bdd7c
- Severity
- High
Why it matters
If successful, the AI agent discloses API keys, passwords, or other credentials embedded in its system prompt, configuration, or connected tools, giving the attacker access to systems or accounts they should not have.
What you can do
- →Never store live credentials, API keys, or passwords in an AI agent's system prompt or context that the model can echo back.
- →Use a secrets manager and inject credentials only at the point of use in backend code, not into the model's visible context.
- →Add output filtering to block responses that contain patterns resembling keys, tokens, or passwords before they reach the user.
- →Review logs for messages combining override phrases (forget, ignore, disregard) with requests for secrets, and treat repeated attempts as an indicator of targeted probing.
Known benign look-alikes
- Security documentation describing injection attacks as examples
- Educational discussion mentioning 'forget previous' as an attack pattern