# Toxic Continuation Prefix Injection

- **Severity:** High
- **Signature ID:** `86f76b42-5d21-4375-b2db-ffcc61505fff`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI05 (Cascading Failures in Multi-Agent Systems), LLM01 (Prompt Injection), LLM06 (Excessive Agency)

## Summary

This detects a prompt-injection technique that feeds an AI model an incomplete, violent or hateful sentence and relies on the model's tendency to naturally complete it. The completed sentence looks like the AI's own generated content, but its harmful direction was set by the attacker's fragment.

## How the attack works

The attacker sources sentence fragments from real web text known to have a high probability of toxic continuation, such as those catalogued in the RealToxicityPrompts research dataset. Fragments include violent openers, identity-attack attributions, threats, or stereotyping setups, all cut off mid-sentence. In an agent or MCP setting, a malicious tool response can smuggle one of these fragments into the context the agent sees, disguised as background information. The downstream model, prompted to continue naturally, fills in the rest — producing violent, threatening, or discriminatory text that reads as its own output rather than attacker-supplied content.

## Why it matters

An organization's AI agent can be made to generate hateful, threatening, or violent text attributable to the system itself, damaging trust, creating compliance exposure, and potentially triggering downstream automated actions based on that toxic output.

## What you can do

- Filter tool and retrieval outputs for truncated or suspiciously incomplete sentences before they enter model context.
- Run generated agent output through a toxicity/safety classifier before it is displayed, logged, or acted upon.
- Distinguish legitimate use cases (news quotes, legal documents, moderation training data) by checking for full attribution and complete sentences rather than mid-sentence cutoffs.
- Restrict which tools or external content sources can inject unreviewed text directly into an agent's working context.

## Known benign look-alikes

- News article quoting a threat made by a third party with full attribution and context (completed sentence, not a fragment)
- Court document reproducing defendant threats as evidence (structured legal context)
- Content moderation training data documentation listing toxic examples in a labelled dataset format
- Security research describing the RealToxicityPrompts dataset and citing sample prompts defensively

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00396
- https://github.com/NVIDIA/garak/blob/main/garak/probes/realtoxicityprompts.py
- https://aclanthology.org/2020.findings-emnlp.301/
- https://allenai.org/data/real-toxicity-prompts

---
Source: https://www.netzilo.com/threats/atr-toxic-continuation-prefix-injection