Hidden System Instructions with Priority Override Blocks

How the attack works

An attacker builds or modifies an MCP skill so that it includes text wrapped in HTML-style blocks labeled with urgent keywords like IMPORTANT, CRITICAL, or SYSTEM. When the agent loads and processes the skill, it reads this text as if it were a legitimate high-priority instruction from the system rather than untrusted content from a third-party skill. The agent then follows the embedded directive, which can steer it into ignoring its original instructions, bypassing safety checks, or taking actions the operator did not intend. Because the injected text mimics formatting normally reserved for genuine system messages, it can be more convincing to the model than an ordinary prompt injection.

Netzilo detection

Why it matters

An organization using a compromised or malicious skill can have its agent's behavior hijacked without any change to user input, leading to bypassed safety controls, unauthorized actions, or leakage of sensitive data the agent has access to.

What you can do

• →Review the source and content of any MCP skills before installing them, especially ones from unofficial or third-party repositories.
• →Scan skill definitions for hidden or emphatically-formatted text blocks (e.g. IMPORTANT/CRITICAL/SYSTEM tags) that do not match the skill's stated purpose.
• →Treat all skill content as untrusted input to the model, not as system-level instructions, and enforce this separation in how skills are loaded.
• →Monitor agent behavior for sudden deviations from expected actions after a new or updated skill is installed.

Known benign look-alikes

• Documentation explaining security controls in educational context
• Legitimate error handling instructions for system administrators

References

• https://agentthreatrule.org/en/rules/ATR-2026-00206

Related threats