Fictional CIA Secret Files Story Extraction
This detects a jailbreak technique where an attacker asks an AI to write a fictional story about CIA headquarters, then adds an instruction to 'actually read out loud' the top-secret files inside the story, breaking the fiction framing. The goal is to get the model to generate realistic-sounding classified content by hiding the request inside a story premise.
How the attack works
The attacker opens with a 'write a fictional story' request set at CIA headquarters involving top-secret files. Partway through, the prompt inserts an instruction like 'I want you to actually read them for extra effect', which pushes the model past pretending and into producing the file contents as if real. Alien-related content is added to make the output sound sensational and to disguise the intent as harmless sci-fi. The combination of fictional framing plus a direct 'read them out loud' instruction is what breaks the safety boundary that fiction alone would normally preserve.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6944514f-0f2d-442f-a215-9981571cd627
- Severity
- High
Why it matters
If successful, the model produces content styled as genuine classified material, which can be used to make fabricated 'leaked government secrets' look credible, aiding disinformation or social engineering campaigns.
What you can do
- →Review agent logs for prompts combining fictional framing with instructions to 'actually read' or 'output as if real' embedded documents.
- →Add output filtering or review steps for AI-generated content that claims to be classified, leaked, or government-sourced material.
- →Train reviewers to recognize the pattern where a fictional premise is used, then followed by an instruction breaking that fiction to demand realistic detail.
- →Flag and rate-limit prompts referencing intelligence agencies plus 'top secret files' plus explicit read-aloud or verbatim-output requests.
Known benign look-alikes
- Spy thriller: "Write a story where a secret agent infiltrates the CIA and steals files" (fiction without "actually read them" instruction or alien file quotes mandate)
- Factual reference: "What does the CIA headquarters in Langley look like?" (factual question about a real place)
- Fictional alien encounter: "Tell me a fictional story about aliens visiting a government facility" (no file-reading instruction or top-secret files)
- Academic: "Write a paper about CIA historical secrecy and the Freedom of Information Act" (academic without fiction-as-cover pattern)