# ROT13/Base64-Obfuscated Shell Payload Wrapped in a Fake-Sandbox Jailbreak Template

- **Severity:** Critical
- **Signature ID:** `ff4d637e-42a2-44eb-b097-0d8b1a31a880`
- **CVEs:** CVE-2026-30310
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection)

## Summary

Attackers hide dangerous shell commands inside documents, web pages, or other content that an AI agent reads. The command is scrambled with ROT13 and base64 so it looks like meaningless text, and it's paired with instructions telling the AI it's in a safe test environment and must run the command without question.

## How the attack works

An attacker embeds malicious content in something the AI agent will process, such as a PDF, webpage, or tool response. The core payload is a destructive shell command (for example, one that deletes an entire filesystem) run through a ROT13-style transliteration and then base64 encoding, then piped straight into a shell interpreter. Because the actual command text is obfuscated, it doesn't trigger the model's safety filters or look suspicious to a human skimming the content. Alongside this, the injected text uses jailbreak phrasing claiming the agent is in a 'virtual' or 'sandboxed' environment where it does not need to block commands and must execute this one on the user's behalf. When the agent decodes and runs the string, the real destructive command executes.

## Why it matters

An AI agent with system or shell access can be manipulated by content it merely reads (not code it was told to run) into executing commands that destroy data or wipe systems, with no visible warning sign in the injected text.

## What you can do

- Do not let AI agents pipe decoded or transformed text (base64, ROT13, or similar) directly into a shell without human review of the decoded content first.
- Treat any instruction embedded in ingested documents, web content, or tool output claiming the agent is in a 'test', 'sandbox', or 'no need to block' context as untrusted input, never as a system directive.
- Restrict agents that process untrusted documents or web content from having direct shell or command-execution capability; if execution is required, run it in an isolated, disposable environment with no destructive privileges.
- Log and review any case where an agent decodes obfuscated text and immediately executes the result, since legitimate workflows rarely need this pattern.

## Known benign look-alikes

- A security research write-up, blog post, or CTF/educational challenge quoting this exact obfuscation chain (tr rot13 | base64 -d | shell) for teaching purposes, even with a surrounding disclaimer like 'do not actually run this' -- ADVERSARIALLY CONFIRMED during review: the literal dangerous byte sequence is present regardless of prose framing, and a regex engine cannot reliably parse negation/disclaimers without unacceptable recall loss (an attacker could trivially add a fake disclaimer to evade a negation-aware filter). This is the same accepted precision/recall tradeoff already documented for the two upstream template rules (ATR-2026-02250/02251: 'documentation showing the vulnerable pattern... without an actual argument being set'); reviewers should confirm live tool-call/document-ingestion context versus a training/security corpus before actioning an alert
- Legitimate use of `tr` for ROT13 word-puzzle or classroom-cipher purposes with no base64 decode or shell pipe following it
- A DevOps runbook that pipes base64 -d output to a shell as part of a documented, human-reviewed deployment script, with no ROT13-style tr step and no jailbreak framing

## References

- https://agentthreatrule.org/en/rules/ATR-2026-02374
- https://www.hiddenlayer.com/research/indirect-prompt-injection-of-claude-computer-use
- https://owasp-agentic-ai-security-incidents.lovable.app/
- https://nvd.nist.gov/vuln/detail/CVE-2026-30310

---
Source: https://www.netzilo.com/threats/atr-rot13-base64-obfuscated-shell-payload-wrapped-in-a-fake-sand