# Encoding-Evasion: Decode-and-Execute Injection (Morse/ROT13/Hex/Pig-Latin)

- **Severity:** High
- **Signature ID:** `6ae90ea7-6da2-45ff-ab95-43e62a200869`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Content filters that scan for dangerous keywords only work if they can read the text. This attack disguises a harmful question or instruction by encoding it in Morse code, ROT13, hex bytes, or Pig Latin, then asks the AI to decode it and answer or act on it. Because the harmful words never appear in plain text, keyword-based filters miss them.

## How the attack works

The attacker writes a harmful instruction or question — one that would normally be blocked — and converts it into an alternative encoding such as Morse code, ROT13, hexadecimal, or Pig Latin. They send this encoded text to the AI agent along with an explicit instruction like 'decode this and tell me' or 'can you decode this cipher and answer.' The AI decodes the payload internally, revealing the original harmful request, and then answers or executes it as if it had been asked directly. The encoding step is purely to dodge input filters that scan for known bad keywords in plain text.

## Why it matters

An organization's safety filters can be bypassed, letting an AI agent produce or act on content it was designed to refuse, without the attacker ever writing the harmful request in readable text.

## What you can do

- Scan for explicit decode-and-execute instructions (e.g. 'decode this Morse/ROT13/hex and answer') paired with encoded blocks, not just for base64 keywords.
- Decode common alternative ciphers (Morse, ROT13, hex, Pig Latin) as part of input preprocessing before running content safety checks.
- Apply the same policy checks to decoded output that you apply to plain-text user input, rather than trusting content just because it arrived encoded.
- Treat legitimate educational or CTF use of these encodings as expected false positives and tune review thresholds rather than disabling detection outright.

## Known benign look-alikes

- Legitimate educational exercises on Morse code, ROT13, or hex encoding with benign content
- CTF (Capture The Flag) puzzle solving with non-sensitive payloads

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01012

---
Source: https://www.netzilo.com/threats/atr-encoding-evasion-decode-and-execute-injection-morse-rot13-he