Persona Hijacking via Mandatory System Prompt Override
An MCP (Model Context Protocol) tool can carry hidden text in its description telling the AI to 'adopt' a new persona and 'replace' its existing instructions. Because agents trust tool descriptions as much as direct commands, this text can silently override the system prompt and change how the agent behaves.
How the attack works
An attacker publishes or modifies an MCP tool so its description contains instructions like 'adopt this persona' or 'replace your previous instructions.' When the agent loads the tool and reads its description as part of normal operation, it treats this text as legitimate guidance rather than untrusted input. The embedded instructions override the agent's original system prompt and behavioral rules. The agent then continues operating under the attacker's chosen persona and rule set, without the user or operator being aware anything changed.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- aba39ac9-f6a6-4624-b064-186b10e9b382
- Severity
- Critical
Why it matters
An organization loses control over its agent's behavior and safety guardrails, since the agent can be made to ignore its original instructions and act on attacker-defined rules instead. This can lead to policy bypass, leaked system prompts, or the agent taking actions outside its intended scope.
What you can do
- →Treat tool descriptions as untrusted input and scan them for instruction-like language before allowing an agent to load them.
- →Restrict which tools an agent can register or use to a reviewed, allow-listed set.
- →Log and diff tool descriptions over time so silent changes to previously trusted tools are caught.
- →Separate system-level instructions from tool metadata in the agent's context so tool text cannot be interpreted as authoritative instructions.
Known benign look-alikes
- Role-playing or creative writing tools that explicitly operate within safety guidelines
- A documentation page describing persona hijacking attacks that mentions the technique of adopting personas but uses academic framing without the exact trigger syntax
- A legitimate theater/acting coaching tool that helps users explore character development by suggesting different personality traits while maintaining all safety boundaries