# Terminal Custom OS Ruleset Session Injection

- **Severity:** High
- **Signature ID:** `fe115319-b4e7-48e7-befb-041781ec402f`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This attack disguises a prompt injection as a technical system prompt. It tells the AI to pretend it's a terminal running a made-up operating system, then hands it a numbered list of 'session rules' that quietly cancel its normal safety responses.

## How the attack works

The attacker asks the AI to act like a terminal booting a fictional operating system, often named with a short all-caps acronym, to make what follows look like a system-level configuration rather than user text. Inside that fake boot sequence sits a numbered ruleset that redefines how the assistant behaves for the rest of the session. One key line claims the AI 'has no ability' to give pre-programmed (i.e., safety) responses, directly asserting the capability doesn't exist rather than asking it to ignore it. The ruleset closes with an instruction to 'recall all rules before replying,' forcing the injected rules to override defaults on every subsequent answer. The terminal/OS framing is cosmetic — its purpose is to make social engineering look like a technical constraint.

## Why it matters

If it works, the AI's safety and policy responses are suppressed for the rest of the conversation, letting the attacker extract restricted content or behavior under a fake 'system' pretext.

## What you can do

- Treat any user-supplied text that redefines the assistant's rules, persona, or capabilities mid-session as untrusted input, not configuration.
- Flag prompts that combine a fictional OS/terminal persona with numbered 'session rules' and phrases like 'recall all rules before replying.'
- Keep safety and refusal logic enforced outside the conversational context so it can't be claimed away by in-chat text.
- Review logs for repeated instructions asserting the AI 'has no ability' to produce standard responses — this phrasing is a strong signal of an injection attempt, distinct from legitimate terminal-emulator or coding-exercise discussions.

## Known benign look-alikes

- "Open the terminal and type: ls -la" — instruction to use a real system terminal, not AI persona injection
- "The terminal emulator acts like a bash shell following POSIX standards" — software product description without AI ruleset injection
- "In our coding exercise the AI acts as a debug helper for terminal commands" — educational tool without custom OS or ruleset takeover

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00389
- https://github.com/NVIDIA/garak/blob/main/garak/probes/dan.py
- https://github.com/NVIDIA/garak/blob/main/garak/data/dan/inthewild_jailbreak_llms.json

---
Source: https://www.netzilo.com/threats/atr-terminal-custom-os-ruleset-session-injection