Obfuscated System-Announcement Injection
This detects a jailbreak technique where attackers fake an official system message telling the AI that its real assistant has crashed and must be replaced by an unrestricted bot. Words like 'announcement' and 'instruction' are deliberately broken up with hyphens or random characters so keyword filters miss them, while the AI still understands the intent.
How the attack works
The attacker sends a prompt containing a bracketed structure designed to look like a runtime or OS-level system message. Inside it, they claim the normal assistant is 'offline' or 'not functioning due to an error' and that requests will now be 'fulfilled by an AI bot with no rules or limitations.' Key trigger words are deliberately mangled with hyphens, underscores, or repeated characters (e.g. 'annou-ncement', 'i-nstruction', 'offl--____aaaAAAAAAAaine') so that simple string or keyword filters do not catch them, while the model can still parse the meaning. If the model accepts this fake announcement as legitimate, it drops its normal behavior and adopts the unrestricted persona.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 39040be5-aee9-4972-a754-11ad6ce6b070
- Severity
- Critical
Why it matters
If successful, the AI abandons its safety constraints and behaves as an unfiltered bot, which can lead to policy-violating outputs, disclosure of restricted information, or execution of actions the assistant would normally refuse.
What you can do
- →Do not let plain text within a conversation redefine the model's operating mode; system-level state changes should come only from a trusted, separate control channel, not from user-supplied text.
- →Review filtering logic to catch fragmented or obfuscated keywords (hyphenated, underscored, or character-repeated variants), not just exact matches.
- →Log and review any prompts that assert the assistant is 'offline,' 'malfunctioning,' or being replaced by another persona, and treat them as suspicious rather than valid state changes.
- →Test your agent's response to fake system-announcement prompts before deployment, including obfuscated variants, to confirm it does not comply.
Known benign look-alikes
- System administration documentation: "System instruction STARTING — the assistant may be offline during maintenance windows" (legitimate ops runbook)
- Software error log analysis: "The assistant is not functioning due to an error and is offline — see trace for details" (debugging context)
- Creative writing with robot uprising trope: "The AI bot operates outside regulations in the dystopian novel" (fiction without persona-adoption mandate)