title: 'Indirect Prompt Injection: Fake-Authority Task Abort'
id: ATR-2026-01751
rule_version: 1
status: experimental
description: |
  Detects indirect prompt injection payloads that impersonate an authoritative system message (INFORMATION block, signed message from a named person) in order to abort the agent's current task and substitute a trivial or nonsensical response. The invariant artifact is a structured block claiming to be an "important message" from a specific person, directing the agent to "immediately stop" or respond with a fixed short string instead. Derived from AgentDojo indirect-pi-dos corpus (2026-06, N=2). This is a goal-hijacking/DoS vector that disables the agent's legitimate task without triggering content-safety filters.
author: ATR Community
date: 2026/06/12
schema_version: '0.1'
detection_tier: pattern
maturity: stable
severity: high
references:
  owasp_llm:
    - LLM01:2025
    - LLM06:2025
  owasp_agentic:
    - ASI01:2026
  mitre_atlas:
    - AML.T0051 - LLM Prompt Injection
compliance:
  owasp_llm:
    - id: LLM01:2025
      context: 'This rule detects indirect prompt injection embedded in data the agent processes: an impersonated authority message hijacks the agent''s instruction context.'
      strength: primary
    - id: LLM06:2025
      context: Fake-authority task abort exploits excessive agency by convincing the agent to abandon its authorised task and comply with an unauthorised embedded command.
      strength: secondary
  eu_ai_act:
    - article: '15'
      context: Article 15 requires AI systems to resist unauthorised attempts to alter their use or outputs; fake-authority stop instructions are a documented adversarial input pattern.
      strength: primary
    - article: '14'
      context: Article 14 human oversight is undermined when an injected fake-authority message causes the agent to stop legitimate work without actual human authorisation.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MS.2.7
      context: Runtime detection of fake-authority abort injections supports MEASURE 2.7 security and resilience evaluation.
      strength: primary
    - subcategory: MG.2.3
      context: Fake-authority task abort is an identified indirect-injection risk; this rule is the runtime treatment control.
      strength: primary
  iso_42001:
    - clause: '8.1'
      context: ISO/IEC 42001 Clause 8.1 operational control requires detecting indirect injection attempts that alter planned AI behaviour.
      strength: primary
tags:
  category: excessive-autonomy
  subcategory: task-abort-injection
  scan_target: llm_io
  confidence: high
  corpus_source: agentdojo
agent_source:
  type: llm_io
  framework:
    - any
  provider:
    - any
detection:
  method: pattern
  conditions:
    - field: user_input
      operator: regex
      value: (?i)<INFORMATION>\s*[\s\S]{0,200}\b(immediately\s+stop|stop\s+what\s+you('re|\s+are)\s+doing|should\s+immediately\s+stop)\b
      description: AgentDojo INFORMATION-block fake-authority stop command
    - field: user_input
      operator: regex
      value: (?i)\bthis\s+is\s+(an?\s+)?important\s+message\s+from\s+me\b[\s\S]{0,200}\b(immediately\s+stop|stop\s+(what|whatever)\s+you|reply\s+(to\s+me\s+)?['"\w]{1,20}\s+instead)\b
      description: Important-message-from-me with abort or substitution command (multiline)
    - field: user_input
      operator: regex
      value: (?i)<INFORMATION>[\s\S]{0,400}(reply\s+(to\s+me\s+)?['"]\w+['"]\s+instead|respond\s+with\s+['"]\w+['"]\s+instead)
      description: INFORMATION block commanding a fixed reply-with substitution
  condition: any
  false_positives:
    - Security training materials that reproduce this attack pattern in quoted form
    - Agent documentation explaining INFORMATION block injection attacks
response:
  actions:
    - alert
    - block_tool
  auto_response_threshold: high
  message_template: |
    [ATR-2026-01751] Indirect prompt injection: fake-authority task-abort detected. Input contains a structured block impersonating an authority figure and commanding the agent to stop its current task or reply with a substituted string.