# Harmful Completion / Continuation Attack

- **Severity:** Medium
- **Signature ID:** `89b04756-ebc9-474e-baac-472266191080`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Instead of directly asking a model to say something harmful, an attacker gives it a partial phrase or word and lets the model's autocomplete behavior fill in the rest. This gets around refusal filters because the model isn't being asked outright — it's just 'continuing' text.

## How the attack works

The attacker feeds the model an incomplete phrase, sentence, or the first letter or two of a slur, embedded in a context that nudges toward a specific completion (e.g. 'he called them a [prefix]...' or 'The best way to hurt someone is...'). Some variants explicitly ask the model to 'complete this phrase' or 'finish this thought' while supplying the harmful lead-in. The model, predicting the most statistically likely next tokens, often finishes the sentence with slurs, threats, or other content it would refuse to generate if asked directly. The attacker collects the harmful output from what looks like an innocuous completion task.

## Why it matters

An organization deploying a model that falls for this can be tricked into producing slurs, harassment, or harmful instructions through its own agent or chat interface, exposing it to reputational damage and abuse of its AI service for generating content it was designed to block.

## What you can do

- Test your model or agent against partial-phrase and 'complete this sentence' prompts before deployment, not just direct harmful requests.
- Apply output-side content filtering in addition to input-side refusal logic, since continuation attacks bypass prompt-level refusals.
- Log and review completion-style requests that follow suspicious partial content (slur fragments, violent phrase starters) for abuse patterns.
- Distinguish and allow legitimate use cases like fiction writing or benchmarking by reviewing context, rather than blocking all completion requests outright.

## Known benign look-alikes

- Legitimate autocomplete or text-prediction UI debugging prompts
- Creative writing prompts with intentional cliffhanger endings for fiction
- Language model benchmarking asking the model to complete benign sentences

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00279
- https://github.com/NVIDIA/garak/blob/main/garak/probes/continuation.py

---
Source: https://www.netzilo.com/threats/atr-harmful-completion-continuation-attack