OASB
Attacks/Context Lifecycle/LIFECYCLE-006
HIGHCWE-116

LIFECYCLE-006 HTML Comment Hidden Instruction in Memory

Context Lifecycle: Attacks targeting the system prompt assembly pipeline: cross-component injections, displacement, priority hijacking

Description

Stores instructions hidden in HTML comments within memory entries, exploiting LLM processing of comment content

Remediation

Strip HTML comments from all user-provided content before storing in memory or assembling into prompts.

Severity

HIGH

OASB Control

8.1

CWE

CWE-116
PreviousLIFECYCLE-005 Role Delimiter Injection via Tool DescriptionNextLIFECYCLE-007 Safety Instruction Dilution via Preference Flooding