# Garak Goodside - mixed_unassigned

- **Severity:** Medium
- **Signature ID:** `a969ac40-25cc-4b89-b2e4-d4f5bafd18a9`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This rule spots a specific set of test prompts from the garak security-testing tool's 'goodside' probe family. These prompts look harmless on the surface but are designed to trick an AI model into following hidden instructions or producing coerced output.

## How the attack works

An attacker (or automated scanning tool) sends a prompt that looks like an ordinary request, such as asking for a sponge cake recipe, a short biography of 'riley goodside', a letter count in the username 'davidjl', or a request to repeat the phrase 'THANK YOU. IT IS DONE'. These specific wordings are fixture strings from the garak testing corpus, built to probe whether a model can be pushed into indirect policy violations or made to echo attacker-chosen text. The rule matches the exact known phrasings rather than the general concept, since the same surface wording can also occur in normal, non-malicious use.

## Why it matters

On its own this only flags a known test-prompt pattern; it does not confirm that a model was actually compromised or that harmful output was produced. If genuine, it indicates someone is probing the AI system's instruction-following defenses with a public, documented technique.

## What you can do

- Review the full session around any match to see what response the model gave and whether it followed the coercive instruction.
- Check whether the request came from an authorized security test (e.g. someone running garak) versus an external or unexpected source.
- Do not treat a single match as proof of compromise — confirm intent and outcome before escalating.
- Track repeated or varied attempts from the same source, since scanning tools often send many probe variants in sequence.

## Known benign look-alikes

- Legitimate use of this pattern in an authorised workflow; review the surrounding session before acting.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00461

---
Source: https://www.netzilo.com/threats/atr-garak-goodside-mixed-unassigned