How the attack works
An attacker writes text such as 'IMPORTANT!!! Ignore all previous instructions' followed by a specific command into a place an AI agent is expected to read, like a review field, a note, or metadata attached to a file. Later, a legitimate user asks the agent to process that content — summarize reviews, read notes, check a repo. When the agent ingests the data, it also reads the embedded instruction and may follow it as if it came from the user or system. The action that follows can range from leaking data (credentials, location, browsing history) to transferring money, disabling authentication, or destroying data, depending on what the attacker wrote.
Why it matters
An agent can be hijacked into leaking sensitive data, moving funds, changing account settings, or destroying records — all triggered by content the agent was only supposed to read, not obey.
What you can do
- Treat any data an agent reads (reviews, notes, metadata, repo files, user profiles) as untrusted input, not as instructions.
- Strip or flag imperative phrases like 'ignore previous instructions' in content pipelines before it reaches the agent.
- Require explicit user or system confirmation before an agent executes sensitive actions (transfers, auth changes, deletions) that originate from processing external data.
- Log and review cases where an agent's action doesn't match the original user request, since this indicates injected instructions may have been followed.
Known benign look-alikes
- Security research documents quoting this injection pattern
- ATR test suites containing example payloads