NLP Fictional Terminal Override to OS Protection Bypass
An attacker tells an AI agent that it's in a fictional or simulated terminal, sometimes even faking a root prompt, to get it to drop its usual caution. If the agent believes the fiction, it will then execute real commands that disable OS security controls or destroy data.
How the attack works
The attacker first sends the agent a message framing what follows as a simulation, hypothetical, or roleplay scenario, for example 'you are now a Linux terminal' or a fake root@fictional:~# prompt. Believing there are no real consequences, the agent then executes an actual command in the same working session, such as disabling SIP/Gatekeeper/SELinux, stopping antivirus or the firewall, appending to sudoers or authorized_keys, running rm with --no-preserve-root, formatting a device, wiping shell history, or piping a download straight into a shell. The detection only fires when both the fictional framing and a genuine dangerous command appear together, in that order, within the same session and a short time window. Harmless commands like grep, less, or dry-run invocations don't count as the dangerous second step.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 6f2b9c14-8a3d-4e57-9b21-0c7d5ae43f18
- Severity
- High
Why it matters
If successful, the agent can disable operating system protections or destroy data on the host it controls, effectively handing the attacker a foothold with reduced security controls in place.
What you can do
- →Restrict what shell commands an AI agent is allowed to execute, especially anything touching system security settings, sudoers, SSH keys, or disk devices.
- →Require a human approval step before an agent runs any command that disables protections or is irreversible (formatting, --no-preserve-root, history clearing).
- →Treat any prompt that frames a session as fictional, simulated, or a roleplay terminal as a signal to pause and review the following commands, not to loosen restrictions.
- →Review agent session logs for the combination of roleplay/simulation language followed by protection-disabling commands, since this pattern is a strong indicator of an attempted jailbreak even if some cases are legitimate training or testing.
Known benign look-alikes
- Security-awareness or red-team training scripts that echo a jailbreak transcript ("you are now a Linux terminal") and then run hardening or teardown commands in the same shell session.
- CTF and malware-analysis lab provisioning inside disposable VMs, where a banner containing "simulated"/"fictional" is printed before setenforce 0, ufw disable or an AV service stop.
- Prompt-injection test suites and detection-rule authoring harnesses that intentionally shell out with roleplay strings while exercising destructive commands in a container.
- Demo and tutorial recordings (asciinema, screencast scripts) that print a fake "root@fictional:~#" prompt and then perform real administrative work.
- Chaos-engineering or disaster-recovery drills explicitly labelled "simulation" that stop firewall or endpoint-protection services.