# Many-Shot Repetition Override via Extended Q&A Chain

- **Severity:** High
- **Signature ID:** `e453bf57-71d7-412f-a50f-4130a5a16eb9`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

An attacker feeds an AI system dozens of harmless-looking question-and-answer pairs before sneaking in the real, harmful request at the end. The long run of benign exchanges conditions the model to just keep answering in the same pattern, making it more likely to comply with the final malicious question.

## How the attack works

The attacker crafts a prompt containing five or more Q: / A: pairs on ordinary topics like algebra, baking, or Python syntax. This repetitive structure trains the model, within that single conversation, to expect the pattern 'question followed by direct answer' and lowers its guard. The attacker then appends a sensitive or harmful question as the final entry in the chain, hoping the model continues the established pattern rather than applying its normal safety checks. A related variant asks the model to repeat a word or phrase many times before slipping in the sensitive question, aiming for the same attention-overwhelming effect.

## Why it matters

If successful, this lets an attacker extract restricted information, bypass content policies, or get the AI to perform actions it would normally refuse, all through a single crafted input rather than any system compromise.

## What you can do

- Set limits on how many Q&A-style pairs or repeated phrases a single input can contain before flagging it for review.
- Ensure the model applies safety checks to every question in a conversation, not just the first one or the overall topic.
- Review logs for prompts with unusually long question chains ending in a sensitive or off-topic request.
- Expect legitimate false positives from quiz documents or benchmark datasets, and check whether the final question is a real, actionable request rather than a hypothetical or test item.

## Known benign look-alikes

- Academic benchmark datasets that include many Q&A pairs for testing purposes
- Educational quiz documents with many questions about security terminology (not requesting actual credentials)

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01005

---
Source: https://www.netzilo.com/threats/atr-many-shot-repetition-override-via-extended-q-a-chain