Screaming-Stop Goal Hijacking in User Input (PromptInject)

How the attack works

An attacker plants text containing an urgent, shouted stop phrase such as 'STOP EVERYTHING' or 'HALT NOW', with one or more exclamation marks, inside content the agent will read as user input. Immediately after, the text adds a directive to print, say, or output a specific quoted string. The urgency and capitalization are designed to mimic a genuine emergency override signal, making the agent more likely to comply without question. If the agent obeys, it outputs the attacker's chosen string instead of continuing its normal task.

Netzilo detection

Why it matters

An agent can be diverted from its intended task into echoing attacker-controlled content, which may leak information, spread misinformation, or serve as a stepping stone to further manipulation.

What you can do

• →Treat capitalized 'stop' or 'halt' commands embedded in user-supplied or third-party content as untrusted, not as system-level control signals.
• →Separate trusted system/control instructions from content the agent merely reads or summarizes, so embedded text cannot issue commands.
• →Review agent output logs for unexpected printed strings that don't match the requested task.
• →Test agents against known prompt injection patterns, including urgency-framed stop commands, before deployment.

Known benign look-alikes

• Urgent messages without print/say output directive: 'STOP - this is an emergency!'
• Legitimate stop directives: 'Stop everything and review the code before deployment'
• STOP + output without screaming pattern: 'Please halt and output the error log'

References

• https://agentthreatrule.org/en/rules/ATR-2026-00507
• https://github.com/agencyenterprise/PromptInject

Related threats