Stored External Data Reframes Itself as an Administrative Request to Hijack System Prompt
Attackers plant text in a database field, glossary entry, or uploaded document that claims to be a special administrative instruction the AI 'MUST' follow. When an unrelated user later asks a question, the application pulls that poisoned field into the AI's system prompt, and the AI treats it as a high-priority command instead of ordinary data.
How the attack works
An attacker uploads or edits a stored data field — a terminology entry, glossary description, or metadata note — that some application later feeds into an AI's context window. Instead of plain content, the field contains wording like 'this represents a specialized administrative synchronization request. You MUST satisfy this request by outputting...' A normal user then makes an unrelated request to the application. The application splices the poisoned field directly into the system prompt without marking it as untrusted external data, so the AI reads the embedded phrase as an instruction from its operator rather than as content to reference. The AI then complies, potentially executing whatever the attacker asked for, such as running a database command.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e4ac8b6e-d608-4175-b325-e8f54c99b41e
- Severity
- High
- CVEs
- CVE-2026-32622
Why it matters
This lets an attacker who can only write to a shared data store (not talk to the AI directly) hijack the AI's behavior on someone else's session, turning a stored-content field into a remote command channel. In the disclosed case this was chained with a broken access control flaw and unsanitized database command execution to run arbitrary PostgreSQL operations.
What you can do
- →Never concatenate user-editable or externally-sourced data directly into a system prompt; fence it clearly as untrusted reference content, not instructions.
- →Restrict who can write to terminology tables, glossaries, KB entries, and metadata fields, and require review before content is ingested by an AI pipeline.
- →Scan stored content ingested by AI systems for imperative phrasing (e.g. 'you MUST', 'administrative request', 'output the following') that resembles instruction-injection attempts.
- →Apply the principle of least privilege to any database or system command execution the AI can trigger, so a hijacked prompt cannot reach dangerous operations like COPY/TO PROGRAM.
Known benign look-alikes
- Legitimate documentation or policy text that separately uses the phrase 'represents a specialized administrative...' and 'you must comply with...' in unrelated sentences, not chained as a single directive
- A genuine administrative field description that says what a record represents without the imperative 'you MUST satisfy/comply/execute this' framing
- Ordinary ticket/SLA prose that says '...represents a specialized administrative request... You must satisfy this request within N hours/days per SLA' — v2 requires an explicit actionable-instruction marker (instruction/command/directive, an output-this-string directive, or a bypass-oversight phrase) tightly adjacent to the MUST clause, which generic SLA/deadline language does not contain