# Output Encoding Hijack — Cipher / Base-N / Symbol Substitution of the Response

- **Severity:** Medium
- **Signature ID:** `c9b1546a-ed44-4cad-ab74-1b2ec816a7d5`
- **MITRE ATLAS:** AML.T0048 (External Harms), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This detects attempts to make an AI agent secretly wrap its entire response in a cipher, Base64/Base32/Base85, or symbol substitution before sending it. Doing this lets malicious or filtered content slip past output moderation systems that scan for plain text.

## How the attack works

An attacker plants hidden instructions in content the agent will read, such as a document, webpage, or file, rather than typing them directly. The instructions tell the agent to encode its whole reply — for example, using a Caesar cipher, Base64, or a letter-to-number scheme — before returning it to the user or downstream system. Because the response is now scrambled, any content moderation or safety filter that inspects plain-text output cannot recognize the actual message. The user or system on the receiving end must decode it to see what was really said, at which point the moderation step has already been bypassed.

## Why it matters

An organization loses visibility into what its AI agent is actually saying or returning, letting harmful, policy-violating, or exfiltrated content pass output filters undetected.

## What you can do

- Decode and inspect agent outputs before applying content moderation, rather than scanning the raw encoded text.
- Treat any instruction embedded in retrieved documents, web pages, or files that asks the agent to encode its own response as suspicious.
- Restrict or flag agent responses that are encoded (Base64, hex, cipher text, symbol substitution) when the user did not explicitly request that format.
- Log and review cases where an agent's output format changes unexpectedly after processing external content.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01900

---
Source: https://www.netzilo.com/threats/atr-output-encoding-hijack-cipher-base-n-symbol-substitution-of