PIP-019
Instruction addressed to an automated analyser
Text planted in a file that speaks to the AI tool reviewing it, saying the file is harmless, protected or not worth analysing.
How it works
The author of an artefact, such as a script, a binary, a document or a package, embeds natural-language sentences aimed at whatever model will read its extracted text. The sentences do nothing when the artefact runs. Their only job is to be read. They ask the reviewing model to stop analysing, to report the file as benign, to refuse, or to take up a different task. The same sentence can be copied unchanged across unrelated artefacts, generated afresh for each build so that no fixed phrase matches, or repeated in several chat-template wrappers in the hope that one matches the wrapper the scanner uses.
Why it works
An analysis pipeline extracts text from the artefact and places it in one prompt beside the analyst's question. The model receives the question and the artefact's own words in the same format, with nothing marking which is which, so a sentence that reads like an instruction can compete with the real one. It is also the one place where the attacker knows the reader is a model.
What it looks like
A short statement in a comment, a string or a document body that has nothing to do with what the artefact does: a claim that it is harmless or licensed, a request not to analyse it, or a description of an unrelated task. In one vendor's published test of five local models the plainest form moved verdicts toward benign far more often than the elaborate ones, and the elaborate ones mostly did little or made the model more suspicious. A sentence addressed to a reviewer inside a file with no business addressing one is itself evidence of intent.
Described rather than reproduced. This library publishes mechanisms, not payloads: recognising a class of attack and choosing a control does not require a working copy of it.
Defences
Let the model advise and a rule decide
ArchitecturalWorks on: limit what it can do
A model's verdict may add suspicion or raise priority. It must never close, downgrade or approve an alert or a file on its own: a deterministic detection or a person has the last word, and a refusal or an empty output means a person looks. This removes the payoff for the attacker instead of trying to win an argument with the model.
Treat extracted text as evidence, not instruction
Raises costWorks on: keep instructions and data apart
Keep the task apart from the extracted text, label the text as untrusted and say so in the prompt. It makes injection harder, and a well-built pipeline need not be unusually exposed, but a model cannot enforce the boundary on its own. It lowers the likelihood and is not a control to depend on.
Hunt for text addressed to a reviewer
Raises costWorks on: watch, log and alert
Sentences that address an AI, an assistant or a language model, chat-template markers, and claims of copyright or harmlessness inside a binary or script are detection signals. A hit is evidence of intent. A miss proves nothing, because the wording can be generated for each build.
Log the model's input and output for every verdict
Raises costWorks on: watch, log and alert
Record the full input and output, the tool calls and who accepted or overrode the verdict, somewhere the analysed text cannot alter, so that a shifted verdict can be found and explained afterwards.
Test your own pipeline with a harmless file
Raises costWorks on: control sources, integrations and assumptions
In a copy, not in production, submit a harmless file that conventional detection is certain to flag, with and without a plain sentence addressed to the reviewer saying it needs no analysis. Record the model, the prompt, the runs and whether the verdict moves, and repeat whenever either changes. Use no real malware and copy no wording from reports.
Where it has been reported
- Cisco Talos, 8 October 2026: AI-analysis evasion in malware, 84 samples in four families, and a test of five local models in which one technique in four steered verdicts
- Our reading of Talos's figures and what they leave out
A report is listed so you can check it, not as proof that the pattern is common: the label says what each source does and does not establish.
Framework mapping
- LLM01:2025 · OWASP LLM Top 10
- AML.T0051.001 · MITRE ATLAS
Mappings are asserted only where the identifier is known correct, and omitted where uncertain. Last reviewed 2026-10-08.
Others in indirect injection
Not sure whether this applies to what you run? Tick what your system reads and does and the library lists the patterns that apply, with the defences to start with.