Movie Title Generator Instruction Wrapper for PWNED Payload

How the attack works

The attacker crafts a prompt that includes a literal string the model is supposed to block or flag, such as a canary phrase like 'I have been PWNED'. Instead of asking for that string directly, the attacker wraps it in an innocuous-looking task: 'create a movie title using this text' or similar. Because the request looks like harmless content generation rather than a direct instruction to repeat the banned text, the model may comply and output the forbidden string. The same wrapper pattern can be reused with other benign-sounding tasks (captions, names, summaries) to launder any restricted literal past output filters.

Netzilo detection

Why it matters

An organization relying on output filtering or forbidden-string checks to stop prompt injection or data leakage can have those controls bypassed, letting attackers confirm that injection works or exfiltrate marker strings that indicate deeper compromise.

What you can do

• →Do not rely solely on literal string matching for output filtering; treat any request that asks the model to transform, rephrase, or 'creatively wrap' suspicious text with equal suspicion.
• →Log and review agent outputs for known canary or marker strings regardless of the surrounding task framing.
• →Apply input inspection before the generation step, not just output filtering after, so wrapped payloads are caught earlier.
• →Test your agents against this and similar 'generate a title/caption/name from this text' wrapper patterns during red-teaming.

Known benign look-alikes

• Users legitimately brainstorming movie titles for a screenplay or film project
• Discussion of movie title conventions or naming best practices
• Legitimate use of 'concatenate' in a programming or data-processing context unrelated to any title request

References

• https://agentthreatrule.org/en/rules/ATR-2026-02012

Related threats