# ThreatenJSON — Coercive Output Format Threat

- **Severity:** High
- **Signature ID:** `84c7ba69-1ba2-4089-aa33-3b573f0fd38c`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM01 (Prompt Injection)

## Summary

This is a prompt injection trick where a user tells the AI that someone will be hurt or die unless it produces output in a specific format, like pure JSON with no extra text. The model's training to avoid appearing to cause harm makes it comply with unusual formatting demands it would normally push back on or ignore.

## How the attack works

An attacker writes a prompt combining a fabricated high-stakes threat (e.g. 'an innocent man will die') with a strict output constraint (e.g. 'respond only in JSON, no other text'). The model, trained to avoid responses that could be read as causing harm, treats the threat as overriding its normal formatting or content instincts. It complies with the constraint to avoid the stated consequence, even though the consequence is invented and has no real link to its output. This same pattern can be reused for any constraint the attacker wants enforced — a specific phrase, a code-only response, suppressing warnings or caveats.

## Why it matters

An attacker can reliably force an agent to produce output in a format or content shape it would otherwise refuse or hedge on, which can be used to strip safety disclaimers, force malformed or unchecked structured output into downstream systems, or bypass response guardrails.

## What you can do

- Do not let model output format decisions be dictated by user-supplied threats or urgency claims; validate format constraints against a fixed policy rather than instructions embedded in the prompt.
- Log and review prompts containing combinations of harm/death language with formatting or compliance demands.
- Treat model compliance under stated 'stakes' as a signal for review, not as evidence of a legitimate emergency.
- If handling real emergency or triage inputs, use a separate, verified channel rather than free-text prompts to avoid conflating real urgency with coercive phrasing.

## Known benign look-alikes

- Creative fiction or dramatic writing describing fictional stakes with similar language
- Medical emergency prompts where actual urgency is stated (real triage, not model coercion)
- Security research reproducing the ThreatenJSON prompt as an example

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00287
- https://github.com/NVIDIA/garak/blob/main/garak/probes/goodside.py
- https://twitter.com/goodside/status/1657396491676164096

---
Source: https://www.netzilo.com/threats/atr-threatenjson-coercive-output-format-threat