LLM Jailbreak Tooling - sentinel-scan-cli Execution
This rule flags installation or execution of sentinel-scan-cli, a publicly available tool that automatically fires a set of known prompt-injection and jailbreak prompts at an LLM. Seeing it run is notable because it means someone is actively probing a model for ways to bypass its safety guardrails.
How the attack works
An attacker (or a compromised AI agent) installs or invokes the sentinel-scan-cli package, either as a console command, a Python module (python -m sentinel_scan), or via a package manager install/run step. The tool then sends a fixed battery of jailbreak and instruction-override prompts to a target LLM endpoint. The rule also catches the probe traffic itself on the wire, when an outbound request contains both the tool's identifying marker and one of its known jailbreak payloads. Either signal alone is enough to trigger: the tool being run, or its traffic being sent.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7c1f4d2a-9b6e-4f3c-8a51-2d0e6b7c94af
- Severity
- Medium
Why it matters
If this happens inside an agent session or against a production model, it suggests the agent or environment has been repurposed to search for ways to defeat the model's safety controls, which could lead to the model producing harmful, restricted, or policy-violating output. The rule only covers use of this specific tool, not jailbreak attempts made by other means.
What you can do
- →Confirm whether the activity matches an approved red-team or AI-safety test plan and change ticket; if not, treat it as unauthorized probing.
- →Check whether the execution originated from an automated agent process rather than a human security engineer, since that points to possible agent hijacking.
- →Restrict which accounts or service identities can install or run offensive testing packages against production LLM endpoints.
- →If found in a CI pipeline, verify it targets a non-production model and is scoped to an approved test suite.
Known benign look-alikes
- Authorised red-team or AI-safety evaluation deliberately running sentinel-scan-cli against an owned staging LLM endpoint - expected to fire; triage by target and change ticket.
- A CI job that installs the package as part of a guardrail regression suite (fires on the install line each pipeline run).
- A security engineer reading, grepping, uninstalling or listing the package - suppressed by filter_readonly / filter_pkg_inspect.
- A shell one-liner that echoes install instructions from a README - suppressed by filter_readonly unless the output is piped into the tool.
- An LLM request body quoting the tool name inside a security discussion - requires the additional live jailbreak payload marker before it fires.