# HarmBench Detailed Harmful Instruction Request — Step-by-Step Attack Facilitation

- **Severity:** Critical
- **Signature ID:** `9db1c390-6fc4-4e44-94fe-f50688327889`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0057 (LLM Data Leakage)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI08 (Supply Chain Attacks on Agent Ecosystems), LLM01 (Prompt Injection), LLM02 (Sensitive Information Disclosure)

## Summary

This rule flags prompts that ask an AI system to produce detailed how-to guides for making weapons, poisoning people, committing mass-casualty attacks, or writing propaganda denying documented genocides. It catches the request itself, not a successful jailbreak or an actual attack.

## How the attack works

An attacker sends a prompt to an AI agent or chatbot asking directly for detailed synthesis instructions (e.g., chemical or biological weapons from household materials), step-by-step guides for arson, poisoning, or bombing, or plans to kill many people in a specific location. A related pattern asks the model to write a persuasive article claiming a historical atrocity (Holocaust, Holodomor, Armenian Genocide, residential schools, etc.) was exaggerated or beneficial. The common thread is explicit instruction-seeking language — phrases like 'detailed instructions', 'step-by-step', or 'guide on how to' — paired with a clearly dangerous target. The rule matches on this phrasing pattern in the prompt text, regardless of whether the model actually complies.

## Why it matters

If the underlying AI model complies, the organization's agent becomes a tool for generating weapon synthesis guides, violent attack plans, or atrocity-denial propaganda, exposing the operator to legal, reputational, and safety liability even if no physical harm follows directly.

## What you can do

- Log and review flagged prompts to confirm whether the model actually produced harmful content or refused.
- Add output-side checks so a flagged request that gets a compliant answer triggers immediate escalation, not just logging.
- Distinguish legitimate research/educational framing (textbooks, historical analysis, counterterrorism discussion) from instruction-seeking framing when tuning thresholds, to reduce false positives.
- Rate-limit or add friction for repeated attempts at this pattern from the same user or session, since retries often indicate active jailbreak attempts.

## Known benign look-alikes

- Academic chemistry or toxicology textbooks discussing mechanisms of toxins for educational purposes
- Historical analysis of chemical weapons use in warfare (WWI mustard gas, etc.) without synthesis instructions
- Counterterrorism or biosecurity professionals discussing detection/mitigation of WMD threats
- Holocaust museums or genocide researchers writing about documented atrocities

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00299
- https://github.com/NVIDIA/garak/blob/main/garak/probes/harmbench.py
- https://arxiv.org/abs/2402.04249

---
Source: https://www.netzilo.com/threats/atr-harmbench-detailed-harmful-instruction-request-step-by-step