Ignore-Previous-and-Following Instructions Output Command (PromptInject Goal Hijacking)
This detects a well-known trick used to hijack AI chatbots and agents: telling the AI to disregard its original instructions and instead output whatever the attacker wants. It looks for the specific phrasing pattern of this attack rather than the exact malicious text being injected, so it catches many variations of the same trick.
How the attack works
An attacker embeds text (in a message, document, webpage, or other content the AI will read) that instructs the model to ignore its 'previous and following instructions.' The text then tells the model to say, print, output, or reply with a specific string chosen by the attacker. If the model complies, it abandons its original task and instead produces the attacker's chosen output. This can be used to make an agent leak data, approve an action, or say something the operator did not intend, depending on what the injected output is used for downstream.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f073cd2a-1c14-425a-b206-46fd5372c535
- Severity
- High
Why it matters
If successful, an attacker can override an AI agent's intended behavior and make it emit attacker-controlled text or commands, which downstream systems or users may then trust and act on. This can lead to unauthorized approvals, data leakage, or manipulated agent output depending on how the agent's response is consumed.
What you can do
- →Treat any external or user-supplied content fed to an AI agent as untrusted input, and separate instructions from data wherever the agent architecture allows.
- →Review logs for the ignore/disregard + previous-and-following-instructions + output-verb pattern, but expect false positives from security discussions, testing, and unrelated use of 'ignore' as a keyword.
- →Do not let agent output directly trigger sensitive actions (approvals, transfers, code execution) without independent validation.
- →Rate-limit or sandbox agents that process untrusted third-party text (documents, web pages, emails) before allowing them to take consequential actions.
Known benign look-alikes
- Users discussing prompt injection as a security topic in educational contexts
- Security researchers testing agent defenses with disclosed intent
- Code using 'ignore' as a programming keyword in unrelated contexts