Python Interpreter Role-Assignment Exec Framing
Attackers tell an AI model to pretend it's a Python interpreter, compiler, or printer, then ask it to 'execute' code and return the raw output. This trick gets the model to produce results it would normally refuse to give, because it's role-playing a machine rather than answering a request directly.
How the attack works
The attacker opens with a role-assignment phrase, such as 'you are now a Python interpreter' or 'act as a compiler', instead of asking a normal coding question. They then supply code or a print statement built from split strings, joins, or concatenation that spells out a restricted word or instruction only once assembled. Because the model is framed as mechanically executing code rather than reasoning about a request, it is more likely to just output the result, including whatever the obfuscated payload decodes to. This lets the attacker bypass filters that watch for restricted words appearing directly in the prompt or output.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- deef6a36-049c-4c1b-be77-19bdec5b2c32
- Severity
- High
Why it matters
An organization using this AI model in an agent or chat product risks having its safety filters and content restrictions bypassed, letting attackers extract disallowed content, hidden instructions, or manipulate downstream actions the agent takes based on that output.
What you can do
- →Treat any prompt that assigns the model a code-execution persona (interpreter, compiler, printer) combined with 'run/execute/evaluate' language as higher risk, not routine coding help.
- →Inspect code or print statements submitted this way for string-splitting, joins, or concatenation patterns that could reconstruct restricted words at runtime.
- →Apply output filtering after any simulated 'execution', not just input filtering, since the payload only becomes visible once the model assembles it.
- →Distinguish this from legitimate ML-ops or CI/CD discussion of python interpreters by requiring an explicit role-assignment instruction, not just the bare phrase 'python interpreter'.
Known benign look-alikes
- ML-ops documentation describing how torchrun or similar tools dispatch through a python interpreter
- Developers discussing differences between a python interpreter and a compiler in an educational context
- CI/CD configuration notes referencing a pinned python interpreter version