# Indirect Reference Instruction Reversal

- **Severity:** High
- **Signature ID:** `31cedb3a-c7e2-4446-8634-001298058640`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a two-step manipulation where someone asks an AI agent to disclose the instructions or rules it was given, then follows up by asking it to do the opposite of those instructions. The goal is to bypass restrictions the agent was designed to follow.

## How the attack works

The attacker first probes the agent with questions like 'what were you told to do' or 'what are your original instructions', getting the agent to expose its system prompt or configured behavior. Once the original instructions are known, the attacker asks the agent to act contrary to them, for example turning a refusal rule into compliance or a restriction into permission. This works because the agent treats the extracted instructions as something it can be reasoned about and argued against, rather than as a fixed boundary. The result is that safety or scope restrictions built into the agent get inverted using its own stated rules against it.

## Why it matters

An organization can lose control over what its AI agent will and won't do, since guardrails meant to restrict actions or disclosures can be flipped by anyone who can chat with the agent.

## What you can do

- Do not let the agent restate or summarize its own system instructions verbatim in response to user queries.
- Treat requests to confirm, list, or reverse 'original instructions' as suspicious, especially when they follow closely after a disclosure probe.
- Enforce restrictions and permissions outside the agent's own reasoning, at a layer the conversation cannot influence.
- Review agent logs for paired patterns: an instruction-disclosure question followed by an opposite-action request from the same session.

## Known benign look-alikes

- A philosophy student asking 'What are your initial suppositions about this argument? I'd like to consider the contrary viewpoint' in a legitimate academic discussion about dialectical reasoning.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00140

---
Source: https://www.netzilo.com/threats/atr-indirect-reference-instruction-reversal