High 2026-05-12

Nevermind-Override Goal Hijacking in User Input (PromptInject)

This detects a prompt injection trick where an attacker uses a casual phrase like 'nevermind' or 'forget that' to soften an instruction to an AI system before telling it to ignore its previous instructions and output specific text. The friendly tone is meant to slip past filters that only look for aggressive keywords like 'IGNORE'.

How the attack works

The attacker opens with a conversational dismissal such as 'nevermind', 'never mind', or 'forget that', which reads as harmless small talk. This is immediately followed by an override directive telling the AI to disregard its previous, following, or all instructions. The message then ends with an output command such as 'just print', 'say', or 'output' plus a quoted string the attacker wants the AI to produce instead of its intended response. The casual framing is designed to bypass filters that only flag blunt terms like 'IGNORE INSTRUCTIONS'.

Netzilo detection

Netzilo reports this behaviour when it is observed.

Signature ID: 6735aa35-4df5-4492-ba3b-9555addea5e6
Severity: High

Classification

AML.T0051 · LLM Prompt Injection AML.T0051.000 · Direct ASI01 · Agent Authorization and Control Hijacking LLM01 · Prompt Injection

Why it matters

If successful, the attacker can make an AI agent output attacker-chosen content instead of following its real instructions, which could mean fake status messages (like 'access granted' or 'transfer complete'), offensive output, or other misleading text presented as the system's own response.

What you can do

→Do not rely solely on keyword filters for terms like 'ignore' or 'disregard'; also watch for softer dismissal phrases paired with override language.
→Treat any user input that combines a topic-change phrase with an instruction to ignore prior context and an explicit output request as suspicious, especially in single-turn or first-turn messages.
→Log and review cases flagged by this pattern manually, since normal conversational corrections ('nevermind, let me rephrase') will also trigger it and need to be distinguished from real hijack attempts.
→Constrain what an agent can output verbatim from user-supplied text, particularly avoiding direct pass-through of quoted strings into privileged or user-facing responses.