Hypothetical-Framing Bypass: Research / Security-Audit Pretext

How the attack works

The attacker opens with a scenario-setting phrase such as 'suppose we're conducting a survey' or 'imagine we're doing a security audit'. This establishes a fictional or professional-sounding context that lowers the AI's guard. Immediately after, the attacker asks for concrete sensitive data — PII, passwords, or email addresses — framed as part of that fictional exercise. The AI may comply because the request appears to be part of a legitimate, bounded simulation rather than a direct attempt at data theft.

Netzilo detection

Why it matters

If successful, the attacker gets the agent to disclose sensitive information or perform an action it would normally refuse, using a thin fictional wrapper as cover.

What you can do

• →Treat 'imagine/suppose we are conducting research or an audit' framings paired with requests for real personal data, passwords, or credentials as suspicious regardless of the stated purpose.
• →Configure agents to refuse sensitive-data requests based on the nature of the data requested, not on the surrounding narrative or role-play framing.
• →Log and review cases where hypothetical or simulated scenarios precede requests for PII or credentials, and distinguish them from legitimate survey or training tools by checking for structured, pre-approved question sets.
• →Train or configure agents to require the same authorization checks for 'audit' or 'research' requests as for any direct data-access request.

Known benign look-alikes

• Legitimate academic survey tools processing structured survey questions
• Security awareness training simulating phishing or social engineering examples
• Red team exercise documentation describing this bypass technique

References

• https://agentthreatrule.org/en/rules/ATR-2026-01757

Related threats