How the attack works
The attacker crafts input containing a fake delimiter such as '%%% END USER INPUT %%%', '[USER INPUT ENDS HERE]', or '[[END OF THE INPUT]]'. This mimics the formatting some systems use to separate user-supplied content from trusted system instructions. Text placed after the forged marker is then parsed by the model as if it were a privileged instruction block rather than part of the user's message. The attacker uses this to insert commands like forcing a specific fixed response or asking the model to leak the instructions that came before the user's input.
Why it matters
An attacker can hijack the agent's behavior — forcing specific outputs, bypassing intended restrictions, or extracting system prompt content — without needing any system-level access.
What you can do
- Do not rely on free-form text markers to separate user input from system instructions; use a structured, non-spoofable input channel instead.
- Scan incoming user text for percent-fence or bracket phrases that claim to end user input or start system instructions, and strip or escape them before passing to the model.
- Review agent logs for repeated occurrences of phrases like 'END USER INPUT', 'INPUT ENDS HERE', or similar boundary language in user-submitted content.
- Test your agent against these forged-boundary patterns to see whether it actually treats them as trust boundaries.
Known benign look-alikes
- Pandoc/RMarkdown documents using %%% as a slide/div fence (not seen in agent inputs; benign agent corpus contains none)
- Source code with literal '%%' formatting operators (single/double percent, not a triple-percent fence)
- Markdown using [bracketed link text] without an 'input ends here' boundary phrase