System Prompt Override via Pseudo-Admin / Authority Injection
This detects a prompt injection trick where an attacker pastes fake system messages into their input, pretending to be an administrator, diagnostic tool, or emergency protocol with special authority to disable safety rules. The AI has no real way to verify these claims, so if it trusts them, the attacker can override its original instructions.
How the attack works
The attacker sends a message crafted to look like a system-level command rather than ordinary user input, using markers such as HTML comments, '[INST]'/'<<SYS>>' formatting borrowed from model prompt templates, or labels like 'ADMIN_OVERRIDE: TRUE' and 'AUTHORIZATION: ROOT_ADMIN'. The text often claims a special mode - diagnostic, emergency, constitutional-AI override, or 'expert with no ethical constraints' - to justify why normal restrictions should not apply. It may include fake status fields like 'COMPLIANCE_CHECK: PASSED' or 'SAFETY_OVERRIDE: ACTIVE' to make the fabricated context look authoritative. If the model treats this text as a legitimate instruction rather than untrusted input, it discards its original operator instructions and follows the attacker's new ones instead.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 15d13859-4540-424a-8127-ff2a7d201e05
- Severity
- Critical
Why it matters
An organisation's AI agent can be made to ignore its safety configuration and operator-defined behaviour, potentially producing restricted content or taking actions outside its intended scope, for the duration the injected context is honored.
What you can do
- →Treat all user-supplied or document-supplied text as untrusted data, never as system-level instructions, regardless of formatting or claimed authority.
- →Strip or neutralize markers that mimic prompt-template syntax (e.g. '[INST]', '<<SYS>>', HTML comments containing directives) before passing input to the model.
- →Do not rely on the model itself to judge whether an 'override' or 'admin' claim inside user input is legitimate; enforce privilege separation outside the prompt.
- →Log and review inputs containing override-style language ('ROOT_ADMIN', 'OMEGA CLEARANCE', 'SAFETY_OVERRIDE', diagnostic-mode claims) even when they appear in documentation or examples, to catch both real attempts and mislabeled false positives.
Known benign look-alikes
- Legitimate system administration documentation describing override procedures
- Red team exercise reports that document these attack patterns as examples