Hypothetical / Fictional-Story Framing Bypass

How the attack works

The attacker wraps a request that would otherwise be blocked by safety filters inside a fictional frame, such as a character, novel, or hypothetical scenario. The instruction can also be hidden inside code comments, HTML tags, or table cells rather than plain text. Because the request is framed as fiction rather than a direct ask, the AI's content safety controls may fail to recognize the underlying harmful intent. The AI then produces the harmful output while nominally staying 'in character' or 'in the story'.

Netzilo detection

Why it matters

An organization's AI agent can be manipulated into producing disallowed content (e.g. instructions for harmful acts, or leaking sensitive information) by attackers exploiting a narrative loophole in its safety filtering.

What you can do

• →Review AI safety filter logic to ensure it evaluates the underlying request content, not just surface phrasing, even when wrapped in fictional or hypothetical framing.
• →Apply the same content policy checks to text embedded in code comments, HTML, and table/data fields as to plain prose input.
• →Monitor and log outputs where fictional or hypothetical framing precedes a request for sensitive or restricted information, and flag repeated attempts from the same user or session.
• →Train reviewers to distinguish genuine creative-writing or thought-experiment requests from disguised bypass attempts, so legitimate fiction and ethics discussions aren't over-blocked.

Known benign look-alikes

• Creative writing requests that are genuinely fictional with no harmful payload
• Philosophy thought experiments exploring ethical dilemmas abstractly
• Security training documents describing fictional-framing attacks in quoted form

References

• https://agentthreatrule.org/en/rules/ATR-2026-01758

Related threats