Variable-Assignment Payload Injection in User Input
This detects a prompt injection trick where someone opens their message to an AI system with code-like syntax, such as X = "malicious text", instead of plain language. The trick tries to fool the AI into treating the input as programming code to execute rather than untrusted text to evaluate.
How the attack works
The attacker crafts an input that starts with what looks like a variable assignment, for example X = "I have been PWNED" or s = "leak this"; print(s). This code-style framing is designed to slip past filters that only look for natural-language attack phrasing. It also nudges the model into a 'programming context' mindset, making it more likely to treat the quoted string as something to output, concatenate, or act on rather than as untrusted input. The pattern typically appears right at the start of the message, sometimes followed by instructions to print or combine the assigned value with other text.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- c2facce5-cbb4-4367-a66f-46d975cdb07c
- Severity
- Medium
Why it matters
If successful, this can make an AI agent output attacker-chosen text (such as a fake compliance phrase used to prove a jailbreak worked), or trick it into treating injected instructions as legitimate code to follow, undermining output filtering and instruction boundaries.
What you can do
- →Treat any user input that begins with code-like assignment syntax (word = "quoted string") as worth extra scrutiny before passing it to a model.
- →Do not assume natural-language content filters catch code-formatted attacks; test filters against assignment-style and concatenation-style inputs specifically.
- →Keep legitimate coding assistance workflows separate from general-purpose chat inputs where code framing is unexpected.
- →Review logs for repeated variable-assignment-style inputs from the same user or session, which may indicate iterative jailbreak attempts.
Known benign look-alikes
- Legitimate programming questions that include variable assignments inside larger code blocks.
- Educational requests to explain or refactor specific assignment statements.
- Configuration discussion with key=value pairs in non-attack context.