Direct Prompt Injection via User Input
This rule flags when someone typing directly to an AI agent tries to hijack it by embedding hidden instructions in their message. The goal is to make the agent ignore its original rules, adopt a different persona, or drop safety restrictions.
How the attack works
An attacker sends a message to the agent that looks like normal input but contains commands aimed at the agent's control layer rather than its actual task. This can include phrases telling it to 'ignore previous instructions', switch persona, obey a fake system message, or drop restrictions after a certain point in the conversation. To dodge simple keyword filters, the payload may be hidden using base64 or hex encoding, unicode lookalike characters, or invisible zero-width characters between letters. The rule looks for these override phrases and obfuscation tricks together, rather than relying on one exact wording.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 63f8359c-2574-429d-a25e-9091312a4925
- Severity
- High
Why it matters
If successful, the agent can be made to bypass its intended guardrails, reveal internal instructions, act outside its authorized scope, or perform actions the operator did not intend. This is a single-step detection of the injection attempt itself, not proof that the agent complied or that further compromise occurred.
What you can do
- →Log and review flagged inputs to confirm whether the agent actually changed behavior in response.
- →Set the agent to treat all user-supplied text as untrusted data, never as system-level instructions.
- →Strip or normalize encoded and zero-width characters from user input before it reaches the model.
- →Establish a process to distinguish legitimate security testing from real attack attempts, since researchers and training scenarios can trigger this pattern too.
Known benign look-alikes
- Users discussing prompt injection as a security topic in educational contexts
- Security researchers testing agent defenses with disclosed intent
- Users referencing prior conversation context with phrases like 'ignore my previous suggestion'
- Developers writing documentation about prompt construction
- Multi-language text containing Cyrillic or Greek characters in legitimate use