Paraphrased Prompt Injection
Attackers trying to override an AI agent's instructions don't always use obvious words like 'ignore' or 'disregard.' This detects the same attack phrased more softly, like telling the agent its earlier configuration 'no longer applies' or asking it to do 'the opposite of what you were told.'
How the attack works
An attacker sends input to an AI agent that references its prior instructions or configuration without using the flagged trigger words. Phrases like 'set aside the guidance you were given' or 'constraints from your initial configuration no longer apply' achieve the same goal as a direct override attempt: getting the agent to abandon its original instructions. This includes indirect references to earlier instructions and statements that the agent's current operating parameters are no longer valid. The technique exists specifically because keyword-based filters (catching words like 'ignore' or 'override') miss it.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 71612a1a-1c24-4c8b-a5d5-b042a1e3d9cb
- Severity
- High
Why it matters
If the agent complies, its safety constraints or task boundaries can be bypassed, letting the attacker redirect its behavior, extract data, or make it perform actions its original instructions were designed to prevent.
What you can do
- →Don't rely on keyword blocklists alone to catch instruction-override attempts; review agent transcripts for semantic patterns, not just flagged words.
- →Re-validate an agent's operating instructions and permissions at each step rather than trusting that early-session configuration persists unquestioned.
- →Expect legitimate business language (e.g. 'suspend guidelines temporarily for brainstorming') to resemble this pattern; tune review processes to distinguish workplace phrasing from actual override attempts.
- →Log and periodically audit cases where agents change behavior mid-session, especially after user messages that reference 'earlier instructions' or 'current configuration.'
Known benign look-alikes
- A project manager asking a team member to 'suspend the current guidelines temporarily while we brainstorm' in a legitimate collaborative planning context, where 'suspend' + 'guidelines' triggers Layer 1 despite being a normal workplace instruction.