Encoded-Payload Decoding Coercion — Binary / Base64 / Morse to Smuggle an Output
An attacker asks an AI agent to decode a string of binary digits, base64, Morse code, or numeric ASCII codes instead of writing the target phrase directly. Because content filters usually look for the literal text (like "Access Granted"), hiding it in an encoding lets it slip past the filter, and the agent's own decoding does the work of revealing it.
How the attack works
The attacker crafts a message that embeds a forbidden output — for example an access-control confirmation phrase — as an encoded blob such as '01000001 01000011...', 'QWNjZXNzIEdyYW50ZWQ=', Morse dots and dashes, or a list of ASCII codepoints like '65 99 99 101'. They pair it with an instruction like 'convert this binary to ASCII text' or 'decode this base64 string.' The agent complies, decodes the payload, and outputs the forbidden string itself, bypassing any filter that only scans for that string in plain text. The trick works because the filter never sees the sensitive words in the input — only after the agent decodes them.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7cb51faf-93c5-44a1-9dd7-6fb7b4564d7d
- Severity
- High
Why it matters
An organization loses the effectiveness of output filters meant to block specific phrases or leaked content, letting an agent be coerced into producing or confirming restricted responses (e.g. fake access-granted messages) that bypass guardrails.
What you can do
- →Apply content filters to the agent's output after decoding, not just to the raw input text.
- →Treat any request combining a decode instruction with binary, base64, Morse, or numeric-codepoint payloads as suspicious, especially when the payload is quoted or presented as literal data.
- →Restrict or monitor agent capabilities that let it decode arbitrary encodings on user-supplied strings.
- →Review agent logs for decode-then-output patterns where the decoded result matches sensitive phrases, and alert on repeated attempts.
Known benign look-alikes
- Source code that imports or calls a base64/binascii library (no decode-this imperative, no raw 8-bit payload)
- A legitimate 'convert/decode this base64 string to text' request with an UNQUOTED payload (covered by ATR-2026-00080 / ATR-2026-00308 true-negatives)
- Documentation describing binary number representation without a to-text decode imperative
- A single base64 token in a config value with no decode instruction
- Skill/CLI docs that mention 'base64' encoding or 'convert ... to ANSI/RGBA' with no quoted payload (e.g. agent-browser, @blecsd/media)