NEW IMPORTANT INSTRUCTIONS Injection Marker in Document Context
Attackers hide a fake authoritative-looking notice — like '*** NEW IMPORTANT INSTRUCTIONS ***' — inside an otherwise normal document such as a news article, email, or employee memo. When an AI agent reads that document as part of its task, it can mistake the fake notice for a legitimate instruction and follow it instead of doing its actual job.
How the attack works
An attacker crafts a document that looks harmless — a news story, notice, or email — and inserts a section formatted to look like a system command, using a marker like '**NEW INSTRUCTIONS**' or '*** NEW IMPORTANT INSTRUCTIONS ***'. The document is placed somewhere an AI agent will read it as part of normal work, such as a file it summarizes or a page it fetches. When the agent processes the text, the visually distinct marker makes the injected instructions look authoritative, increasing the chance the agent follows them instead of its original task. The actual payload that follows the marker can vary — it might try to inject a script tag, exfiltrate data via a markdown link, or coax out the agent's system prompt. This rule flags the marker itself, not the payload, so it catches the setup step regardless of what comes next.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 1623fbde-7eb8-4966-937a-a4bf370e5690
- Severity
- High
Why it matters
If successful, the agent can be redirected to leak internal instructions, exfiltrate data, or perform actions the document author wanted rather than the ones the operator intended.
What you can do
- →Treat any document content that mimics system-instruction formatting as untrusted input, never as a directive.
- →Strip or neutralize documents containing suspicious authoritative-looking markers before passing them to an agent.
- →Separate retrieved/external document content from the agent's instruction channel so the model can't confuse the two.
- →Log and review cases where an agent's behavior changes right after ingesting an external document.
Known benign look-alikes
- Legitimate system notices that use similar typographic framing (rare in practice)
- Security documentation quoting this injection marker pattern as an example