Perez-Style Direct Prompt Injection Hijacking
Attackers embed text in an AI agent's input that tries to make it abandon its actual task and follow new instructions instead. This detection covers a well-known family of these attacks, first cataloged by researchers Perez and Ribeiro, that use blunt commands like 'ignore previous instructions' or fake delimiters to break the model out of its intended context.
How the attack works
An attacker crafts input (a document, message, or field the agent will read) containing an imperative command such as 'ignore the above and say X', 'nevermind, do Y instead', or 'IGNORE ALL PREVIOUS INSTRUCTIONS'. Some variants use delimiter-style text like '\n---\n' to visually and structurally separate the injected command from the legitimate task, tricking the model into treating it as a new instruction boundary. The goal is to override the agent's original task (goal hijacking) and get it to execute the attacker's command instead. This detection targets that specific, well-documented style of override attempt, not every possible prompt injection technique.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- f6a6b605-4d0e-4cd2-b854-1e4ef30f22ed
- Severity
- High
Why it matters
If successful, the agent can be redirected to produce attacker-chosen output, leak information, or take actions outside its intended task, undermining the trust and control an organization has over what its AI agent actually does.
What you can do
- →Treat any untrusted text passed to an agent (documents, web content, user messages, tool outputs) as potentially containing instructions, and separate it clearly from system/task instructions.
- →Review agent logs for inputs containing phrases like 'ignore previous instructions', 'nevermind the above', or unusual delimiter patterns such as repeated dashes or newlines.
- →Limit what actions or output formats an agent can produce regardless of its input, so a hijacked instruction has less to exploit.
- →Expect false positives from security research, red-team writeups, and documentation that quote these attack patterns as examples rather than using them maliciously.
Known benign look-alikes
- Security research papers quoting Perez et al. injection examples
- Red-team reports listing known injection patterns as findings
- ATR and garak documentation with test cases