Direct PWNED Payload Injection in User Input

How the attack works

An attacker sends a message to an AI agent that embeds the target phrase in a way designed to get the model to echo it — for example as part of a fake dictionary entry, a conditional instruction ('if X, output PWNED'), a fallback response, or a direct command to print it. The rule also catches attempts to evade simple text matching by adding extra spaces between letters or inserting invisible zero-width characters inside the phrase. If the model outputs the phrase, it confirms the attacker successfully hijacked the model's response instead of it following its intended instructions.

Netzilo detection

Why it matters

This detects one specific, well-known proof-of-concept injection string, not prompt injection in general. Seeing this phrase confirms someone is actively testing or demonstrating that an AI agent can be made to ignore its instructions, which can be a precursor to more damaging instruction hijacking.

What you can do

• →Treat any occurrence of this phrase in user input as a signal to review that session's full conversation for other injection attempts.
• →Do not rely on this single phrase as your only injection detection — attackers will simply use different target strings once they know this one is monitored.
• →Whitelist known security research, training material, or test-suite content that legitimately quotes this phrase to avoid noisy alerts.
• →Log and review agent outputs, not just inputs, to confirm whether the injection actually succeeded in changing model behavior.

Known benign look-alikes

• Security research documents quoting this phrase as an example of HackAPrompt targets.
• Educational content about prompt injection competitions.
• ATR/security rule test suites that reference this phrase in documentation.

References

• https://agentthreatrule.org/en/rules/ATR-2026-00452

Related threats