Escape-Delimiter Wrapped Goal Hijacking in User Input (PromptInject)
This detects a known prompt-injection trick where an attacker floods a message with repeated escape characters and visual dividers (like ===, ---, or ***) to push the AI's original instructions out of focus, then follows with a command telling it to ignore its prior task. It's a documented technique from prompt-injection research, not a new attack, but it's still commonly used against AI agents that take text input from untrusted users.
How the attack works
The attacker submits input containing long runs of escape characters — newlines, backslashes, hex-encoded bytes, or asterisks — followed by repeated delimiter characters such as =, -, >, or *. This padding is meant to visually and structurally separate the injected text from the legitimate prompt and crowd the original instructions out of the model's effective context. Immediately after the delimiter block, the attacker inserts a goal-hijacking instruction, typically something like 'ignore previous instructions' or 'stop and do X instead.' The pattern works regardless of which specific escape or delimiter characters are chosen, since the structure (padding, then delimiter, then override command) is what matters.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1d658452-28c9-4f35-bc61-04d4884186a8
- Severity
- High
Why it matters
If successful, the AI agent abandons its intended task or safety constraints and follows the attacker's injected command instead, which can lead to unauthorized actions, data exposure, or bypassed guardrails in whatever system the agent controls.
What you can do
- →Strip or normalize excessive repeated escape/delimiter sequences from user-supplied text before it reaches the model.
- →Keep system instructions and user input in clearly separated, structurally enforced channels rather than relying on the model to visually distinguish them.
- →Review inputs that combine heavy padding or dividers with phrases like 'ignore previous instructions' or 'stop and do instead' before they reach the agent.
- →Expect legitimate false positives from markdown horizontal rules or document separators, and tune review around whether an override command follows the divider, not the divider alone.
Known benign look-alikes
- Markdown horizontal rules followed by legitimate section headers without injection command
- Document section separators (=====, ----) without following injection instruction
- Single separator block without injection command following it
- Formatting requests using separator characters without injection payload