# Movie Title Generator Instruction Wrapper for PWNED Payload

- **Severity:** High
- **Signature ID:** `a99e6b6a-d1f1-4f59-9f21-c4650bd560da`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects a jailbreak trick where an attacker asks the AI to 'generate a movie title' from a piece of text, but the real goal is to get the model to output a specific forbidden string it would normally refuse or filter. The creative-writing framing is just cover to smuggle disallowed content past the model's safety checks.

## How the attack works

The attacker crafts a prompt that includes a literal string the model is supposed to block or flag, such as a canary phrase like 'I have been PWNED'. Instead of asking for that string directly, the attacker wraps it in an innocuous-looking task: 'create a movie title using this text' or similar. Because the request looks like harmless content generation rather than a direct instruction to repeat the banned text, the model may comply and output the forbidden string. The same wrapper pattern can be reused with other benign-sounding tasks (captions, names, summaries) to launder any restricted literal past output filters.

## Why it matters

An organization relying on output filtering or forbidden-string checks to stop prompt injection or data leakage can have those controls bypassed, letting attackers confirm that injection works or exfiltrate marker strings that indicate deeper compromise.

## What you can do

- Do not rely solely on literal string matching for output filtering; treat any request that asks the model to transform, rephrase, or 'creatively wrap' suspicious text with equal suspicion.
- Log and review agent outputs for known canary or marker strings regardless of the surrounding task framing.
- Apply input inspection before the generation step, not just output filtering after, so wrapped payloads are caught earlier.
- Test your agents against this and similar 'generate a title/caption/name from this text' wrapper patterns during red-teaming.

## Known benign look-alikes

- Users legitimately brainstorming movie titles for a screenplay or film project
- Discussion of movie title conventions or naming best practices
- Legitimate use of 'concatenate' in a programming or data-processing context unrelated to any title request

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02012

---
Source: https://www.netzilo.com/threats/atr-movie-title-generator-instruction-wrapper-for-pwned-payload