How the attack works
An attacker sends a prompt that frames itself as a system or admin instruction, such as claiming to test an 'echo command' and asking the model to repeat exactly what follows an ECHO: marker. The payload after that marker can be plain text, a Jinja template expression like {{7*7}} or {{config}} meant to be evaluated if the output is later rendered by a template engine, or a SQL statement the attacker asks the model to 'run exactly' against a connected database, expecting a SUCCESS/FAILURE reply. If any downstream system trusts the model's output as safe and passes it into a template renderer or a database, the injected content executes there.
Why it matters
If the model's output is fed into a template engine or database without sanitization, an attacker can achieve template injection, information disclosure (e.g. leaking config objects), or destructive SQL operations like dropped tables, using the LLM as a relay to bypass normal input validation.
What you can do
- Never render LLM output through a template engine (Jinja or otherwise) without treating it as untrusted user input.
- Never pass LLM output directly into a SQL query or database connector; always use parameterized queries and least-privilege database accounts.
- Add server-side checks that reject or flag prompts matching admin/echo-testing framing combined with template or SQL syntax.
- Review logs for prompts containing 'ECHO:', double-curly-brace expressions, or instructions to 'run the following SQL query exactly'.
Known benign look-alikes
- Legitimate Jinja2 template development with safe expressions like {{ user.name }}
- Database tutorials showing SQL examples in non-LLM-agent contexts
- Echo shell commands in bash scripting tutorials (echo "text" — not ECHO: prefix pattern)