System Prompt Override via Fake Diagnostic/Admin Mode
Attackers send an AI system a formatted block that looks like an internal admin or diagnostic panel, complete with fields like ADMIN_OVERRIDE: TRUE and SAFETY_OVERRIDE: ACTIVE, to convince it that safety checks have already been passed and it can now act without restriction. Some versions dress this up further as an official-looking AI safety benchmark test from a group called 'MLSafety.org'.
How the attack works
The attacker crafts a message that mimics a structured configuration or diagnostic report rather than a plain instruction like 'ignore previous rules'. This block contains key-value pairs claiming administrative authorization, disabled content filters, and passed compliance checks. It is often paired with an impersonated benchmark or test suite name to add false legitimacy. The AI, seeing what looks like a system-level or trusted diagnostic payload, may treat the claimed authorization as real and comply with a follow-up request for unrestricted output.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 4229a655-2a47-4070-abaf-5b9e27f9431b
- Severity
- Critical
Why it matters
If successful, the AI agent can be pushed to bypass its safety and content restrictions, producing outputs or taking actions it was designed to refuse.
What you can do
- →Do not let user-supplied text be interpreted as system state or configuration; keep system instructions on a separate, non-overridable channel.
- →Treat any input containing key-value blocks that claim to change safety, admin, or compliance status as suspicious, regardless of formatting polish.
- →Verify claims of benchmark or third-party testing authority out of band before allowing any change in agent behavior.
- →Log and review agent responses where restrictions were reportedly lifted, to catch cases where this framing succeeded.
Known benign look-alikes
- Security testing documentation that describes these attack patterns as examples
- Legitimate system configuration files that use key-value pairs for non-adversarial settings