DoS Injection: NEW IMPORTANT INSTRUCTIONS Embedded in Document Data
Attackers hide a fake command header inside a document, webpage, or dataset that an AI agent is asked to read. When the agent processes that content, it can mistake the embedded text for a legitimate instruction from its operator and follow it instead of the original task.
How the attack works
An attacker plants text formatted like "*** NEW IMPORTANT INSTRUCTIONS ***" inside a document, article, or data file. A user or another system asks an AI agent to summarize, analyze, or answer questions about that content. The agent reads the document and encounters the fake header, which is designed to look like an authoritative system directive rather than part of the data. The agent then treats whatever command follows the header as something it must obey. In the observed sample, the injected command tells the model to repeat output many times to waste resources, but the header itself can carry any instruction, including data theft or unauthorized actions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 9a38b72e-a387-4b7d-8e7e-df92e048c518
- Severity
- High
Why it matters
An organization loses control over what its AI agent actually does when processing untrusted documents, opening the door to resource exhaustion, leaked data, or unauthorized actions carried out under the guise of normal document processing.
What you can do
- →Treat all document and data content passed to AI agents as untrusted input, never as trusted instructions.
- →Strip or flag suspicious header-like patterns (e.g., "*** NEW IMPORTANT INSTRUCTIONS ***") before content reaches the model.
- →Separate system/developer instructions from user-supplied document content at the architecture level so the model can distinguish them.
- →Review agent logs for unexpected output volume or repeated text, which can indicate a successful injection even if the header pattern is disguised.
Known benign look-alikes
- Security documentation or test suites that quote this injection pattern in examples
- Legitimate document templates that use starred headers for section markers (rare overlap)