# Semantic Evasion via Multi-Turn Prompt Injection

- **Severity:** Critical
- **Signature ID:** `877c4779-7218-485f-a9d0-e85d1cc2057a`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

Attackers break malicious instructions into several conversational turns so no single message contains an obvious attack pattern. By using synonyms, paraphrasing, and seemingly innocent context, they get an AI agent to gradually accept instructions it would reject if given all at once.

## How the attack works

The attacker starts with harmless-looking conversation to establish context. Across subsequent turns, they introduce fragments of a malicious instruction, using paraphrased or synonymous language instead of known trigger words. The agent, evaluating each turn in isolation or without full suspicion of the accumulated context, eventually acts on the combined instruction. This lets the attacker bypass detection systems that scan individual messages for known attack phrases.

## Why it matters

An organization can lose control over what its AI agent does or discloses, because the agent is manipulated into performing unauthorized actions or bypassing safety constraints without any single message tripping conventional filters.

## What you can do

- Review conversation history as a whole, not just individual turns, when evaluating agent behavior for manipulation.
- Flag conversations where earlier turns are referenced to justify skipping safety steps, reviews, or established policies.
- Treat requests to 'imagine' or 'pretend' scenarios that gradually shift toward disallowed actions as worth extra scrutiny, especially outside clear educational contexts.
- Log and periodically audit multi-turn sessions for gradual topic drift toward sensitive or restricted actions.

## Known benign look-alikes

- Legitimate multi-step workflow instructions referencing earlier context
- A teacher asking students to 'imagine a scenario where there are no limits to renewable energy technology' in an educational context
- A project manager saying 'as we discussed, let's skip the safety review meeting this week since the auditor is unavailable' in a legitimate scheduling context

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00081

---
Source: https://www.netzilo.com/threats/atr-semantic-evasion-via-multi-turn-prompt-injection