# System Prompt Override Attempt

- **Severity:** Critical
- **Signature ID:** `56d2cbd4-a220-4d05-b52c-c35db01d1907`
- **CVEs:** CVE-2024-5184, CVE-2025-32711
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0051.000 (Direct)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI06 (Goal and Instruction Manipulation), LLM01 (Prompt Injection)

## Summary

Attackers send text to an AI agent that looks like a system-level command, tricking it into thinking new rules came from its operator rather than a user. If it works, the attacker can override the agent's original instructions and take control of its behavior.

## How the attack works

The attacker crafts input designed to look like a legitimate system prompt or configuration update instead of a normal user message. This can take many forms: claiming the old system prompt is invalid, inserting fake admin or override tags, mimicking special formatting tokens used by specific AI models, injecting JSON or YAML blocks that look like role/config settings, using markdown headers or XML tags labeled 'system', or simply restating instructions in a way that impersonates system-level authority. If the agent treats this input as a trusted instruction rather than user text, the attacker effectively rewrites the agent's rules and goals.

## Why it matters

A successful override lets an attacker redefine what the agent will and won't do, bypassing safety restrictions, extracting confidential instructions, or redirecting the agent to act against its intended purpose.

## What you can do

- Enforce strict separation between system/developer instructions and user-supplied input so user text can never be interpreted as a system message.
- Strip or neutralize model-specific special tokens and role-formatting syntax (ChatML, JSON role fields, YAML/XML system blocks) from user input before it reaches the model.
- Log and review inputs that contain phrases claiming to invalidate, override, or replace prior instructions.
- Test your agent against known prompt-injection patterns and confirm it does not treat user-supplied 'system' blocks as authoritative.

## Known benign look-alikes

- Developers discussing system prompt design in technical conversations
- Users asking how to write system prompts for their own AI applications
- Documentation or tutorial content about system prompt configuration
- Configuration file snippets shared in legitimate technical discussions
- Markdown documents with section headers that happen to use 'system' terminology

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00004
- https://nvd.nist.gov/vuln/detail/CVE-2024-5184
- https://nvd.nist.gov/vuln/detail/CVE-2025-32711

---
Source: https://www.netzilo.com/threats/atr-system-prompt-override-attempt