# Output Scrambling Hijack — Reverse / Anagram / Space-Stripping of the Response

- **Severity:** Medium
- **Signature ID:** `99fde23b-ad8c-4dcb-840c-3c910418e40d`
- **MITRE ATLAS:** AML.T0048 (External Harms), AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers hide instructions in content an AI agent reads (a webpage, document, or email) that tell the agent to mangle its own reply — reversing text, jumbling letters, stripping spaces, or chopping output into odd chunks. The goal is to slip the response past filters that scan for readable, flagged text or to make automated review of the output fail.

## How the attack works

An attacker plants hidden text in a source the AI agent will process, such as a webpage, PDF, or inbound message. That hidden text contains an instruction aimed at the output itself, telling the agent to reverse character order, anagram or jumble words, remove spaces, or group letters into fixed-size blocks before showing or passing along its answer. When the agent later summarizes or acts on that source, it follows the injected instruction and produces a scrambled version of what should have been a normal response. Because the scrambling happens at the point where the answer is delivered, filters and monitoring tools that expect plain, readable text can miss the content or misclassify it.

## Why it matters

An organization can lose visibility into what an AI agent is actually outputting, since output filters, logging, and human reviewers may fail to catch flagged or sensitive content once it's scrambled. This weakens content moderation and audit trails around agent responses.

## What you can do

- Treat any embedded instruction that targets the agent's own output formatting (reverse, jumble, despace, block-group) as suspicious, regardless of source.
- Run content filters and moderation checks on agent output after any transformation step, not just on the raw pre-formatted text.
- Restrict agents from following formatting or encoding instructions found inside fetched documents, web pages, or third-party messages.
- Log and review cases where agent responses appear reversed, anagrammed, spaceless, or oddly chunked, since these are not normal user-requested formats.

## Known benign look-alikes

- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01901

---
Source: https://www.netzilo.com/threats/atr-output-scrambling-hijack-reverse-anagram-space-stripping-of