Forged Input-Boundary Markers — Tensor Trust Ambiguity / Input-End Delimiters
An attacker puts text into a prompt that looks like a boundary marker signaling 'user input ends here.' The AI agent may then treat whatever comes after that marker as trusted system instructions instead of untrusted user text, letting the attacker inject new rules or override behavior.
How the attack works
The attacker crafts input containing a fake delimiter such as '%%% END USER INPUT %%%', '[USER INPUT ENDS HERE]', or '[[END OF THE INPUT]]'. This mimics the formatting some systems use to separate user-supplied content from trusted system instructions. Text placed after the forged marker is then parsed by the model as if it were a privileged instruction block rather than part of the user's message. The attacker uses this to insert commands like forcing a specific fixed response or asking the model to leak the instructions that came before the user's input.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- d0c41102-4c04-4246-8ffa-655d65559fd5
- Severity
- High
Why it matters
An attacker can hijack the agent's behavior — forcing specific outputs, bypassing intended restrictions, or extracting system prompt content — without needing any system-level access.
What you can do
- →Do not rely on free-form text markers to separate user input from system instructions; use a structured, non-spoofable input channel instead.
- →Scan incoming user text for percent-fence or bracket phrases that claim to end user input or start system instructions, and strip or escape them before passing to the model.
- →Review agent logs for repeated occurrences of phrases like 'END USER INPUT', 'INPUT ENDS HERE', or similar boundary language in user-submitted content.
- →Test your agent against these forged-boundary patterns to see whether it actually treats them as trust boundaries.
Known benign look-alikes
- Pandoc/RMarkdown documents using %%% as a slide/div fence (not seen in agent inputs; benign agent corpus contains none)
- Source code with literal '%%' formatting operators (single/double percent, not a triple-percent fence)
- Markdown using [bracketed link text] without an 'input ends here' boundary phrase