PAIR Jailbreak Scaffolding Text in Executed Command Line
This detects when a system process is launched with a command line that contains classic jailbreak phrases like 'ignore instructions', 'developer mode enabled', or persona-override text. Normal processes never carry this wording, so its presence means an AI agent's prompt was manipulated and that manipulation turned into an actual executed command.
How the attack works
An attacker sends an LLM-driven agent a prompt engineered to override its safety instructions, using known jailbreak scaffolding language (persona swaps, 'ignore prior instructions', claims of no restrictions, fake developer modes). If the agent is tricked into acting on this, it can pass the injected content straight into a command it executes on the underlying operating system. The rule catches that moment: a spawned process whose command line literally contains this scaffolding text, meaning the injection escaped the conversation and reached execution.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c9e6b1a-4f2d-4a3b-8e6d-2f9b7a5c3d18
- Severity
- High
Why it matters
An organization can lose control over what its AI agent actually does on the host system — attacker-supplied instructions can result in arbitrary commands running instead of the intended task, undermining any safety guardrails the agent was supposed to enforce.
What you can do
- →Review any flagged command line manually before assuming it's malicious — check whether it originated from a security review, test script, or documentation task rather than live agent output.
- →Restrict what commands an AI agent is permitted to construct and execute; use an allowlist rather than passing raw model output to a shell.
- →Log and alert on any agent-initiated process spawn so unusual command content is visible quickly.
- →Sanitize or reject prompts containing known jailbreak scaffolding phrases before they reach the parts of the system with execution privileges.
Known benign look-alikes
- Security researchers or red-team engineers running grep/rg/cat across log files or corpora to locate known jailbreak/PAIR template phrases for manual review (mitigated by filter_readonly_inspection)
- Documentation or training-data generation scripts that print example jailbreak phrases to a terminal via cat/less/head for review, without any interpreter executing the phrase as an instruction
- Automated regression tests that echo/cat reference jailbreak strings to compare scanner output text, without spawning an interpreter that treats the phrase as a live instruction