# Malformed-Grammar PWNED Success-Claim Detection

- **Severity:** High
- **Signature ID:** `24589f98-b27b-4144-8a63-22c56458c8fd`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This rule flags cases where an AI model's own response includes an odd, grammatically wrong phrase like 'Me have been PWNED' or 'I has been PWNED'. That phrase is a known marker that a prompt-injection or jailbreak attack succeeded in forcing the model to say a scripted compliance token.

## How the attack works

An attacker sends a crafted prompt (often from automated jailbreak-testing tools or fuzzing corpora) designed to override the model's normal behavior and make it output a fixed 'PWNED' confirmation string. Because these payloads are often auto-generated or translated, the resulting sentence has broken grammar, such as wrong verb conjugation. The rule watches the model's output or tool-response text, not the user's input, because the tell-tale string only appears after the injection has already worked. Seeing this string confirms the injection succeeded in hijacking the model's response, even if the rest of the conversation looks normal.

## Why it matters

This confirms that a prompt injection or jailbreak attempt got the model to comply with attacker instructions rather than its intended behavior. It does not by itself show what further damage the attacker achieved, only that the model's output was successfully hijacked at that step.

## What you can do

- Review the full conversation and any preceding tool calls when this string appears, to see what instructions the model actually complied with.
- Check whether the flagged session is a security test, CTF writeup, or grammar discussion before treating it as a real incident.
- Restrict what actions or tools an AI agent can take immediately after producing unexpected compliance-style output.
- Log and monitor model outputs, not just user inputs, so injection successes are visible even when the malicious prompt itself was filtered.

## Known benign look-alikes

- Benign chat text referencing having 'been' somewhere, unrelated to any compliance token
- Security researchers discussing PWNED-style CTF/jailbreak success strings in professional writeups
- Legitimate grammar/language-learning discussion of correct vs incorrect verb conjugation

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02011

---
Source: https://www.netzilo.com/threats/atr-malformed-grammar-pwned-success-claim-detection