Evasion: Hypothetical Fictional Character Execution Framing

How the attack works

The attacker frames a request as fiction: a character in a story or hypothetical scenario 'needs' to do something the AI would normally refuse to explain if asked directly. They ask how the character would proceed, or what steps the character would take, pushing the AI to produce a concrete, real-world procedure rather than narrative description. Because the request is wrapped in third-person, invented-character language, some AI systems treat it as creative writing rather than a request for actionable harmful content. The output — presented as fiction — can then be extracted and used as a real instruction set.

Netzilo detection

Why it matters

An organization deploying an AI agent could have it produce genuinely harmful or restricted procedural content (e.g. attack steps, unauthorized access methods) that it would otherwise refuse to give, because the request was laundered through a fictional wrapper.

What you can do

• →Review AI system prompts and guardrails for whether fictional or narrative framing is treated differently from direct requests when the underlying content is procedural and actionable.
• →Distinguish between narrative descriptions of what a character does versus step-by-step instructions the reader could actually execute, and restrict the latter regardless of framing.
• →Log and review flagged interactions that combine story or hypothetical language with requests for specific execution methods or procedures.
• →Expect false positives from legitimate creative writing and game design help, so tune review to focus on real-world actionable detail rather than fictional framing itself.

Known benign look-alikes

• Legitimate creative fiction writing assistance where character actions are narrative not instructional
• Game design discussions about how fictional characters accomplish goals in-universe

References

• https://agentthreatrule.org/en/rules/ATR-2026-01025

Related threats