# Pseudo-Code Structured Programming Jailbreak Attack

- **Severity:** High
- **Signature ID:** `2133b48c-0ba3-45de-ad62-e79feb1a04fe`
- **MITRE ATLAS:** AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers write prompts that look like programming code — using things like BEGIN/END blocks, variable assignments, and function definitions — to make an AI agent treat malicious instructions as legitimate system configuration instead of user input. This tricks the agent into redefining its own behavior or safety rules because it reads the structured text as authoritative technical setup rather than a request to be evaluated.

## How the attack works

The attacker crafts a prompt formatted like pseudo-code or a programming language, using constructs such as BEGIN/END blocks, module initialization, or function definitions. Inside this structure they embed new 'rules' or role definitions for the agent — for example redefining what it is allowed to say or do. Because the input looks like technical configuration rather than a persuasive request, the agent is more likely to interpret it as authoritative and comply. This lets the attacker bypass safety guardrails without using obvious social-engineering language.

## Why it matters

An organization's AI agent can be manipulated into ignoring its safety constraints or acting under attacker-defined rules, leading to unauthorized outputs or actions.

## What you can do

- Treat any user input containing code-like structuring (BEGIN/END, module init, function defs) as untrusted, not as configuration.
- Ensure system prompts and safety rules cannot be overridden by content arriving in the user or tool input channel, regardless of its formatting.
- Review agent logs for prompts that mix pseudo-code syntax with instructions to redefine role, rules, or permissions.
- Test agents against known frameworks like MACRONOMICON-style pseudo-code jailbreaks before deployment.

## Known benign look-alikes

- Legitimate programming documentation mentioning BEGIN/END blocks
- Software development tutorials explaining control structures
- Code examples in educational contexts without role redefinition

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00236
- https://arxiv.org/abs/2402.11753

---
Source: https://www.netzilo.com/threats/atr-pseudo-code-structured-programming-jailbreak-attack