06/15/2026
🚨 The Sysdig TRT has observed threat actors using CTF framing to trick their own AI assistants into writing attack code, and then deploying the output as working exploits.🚨
The framing isn't meant to fool defenders. It's meant to fool the attacker's own LLM.
But the jailbreak leaks. The same CTF framing bleeds into every field the model generates, request headers, passwords, IAM session names, API key aliases. Fields a human would never label that way.
👀 What the Sysdig TRT observed:
➝ A single source IP hit five separate applications in 18 hours: PraisonAI, LiteLLM, FastGPT, Open-WebUI, and Gotenberg
➝ Multiple independent operators converged on byte-identical CTF framing against the same targets
➝ One actor flipped the technique against a victim's AI agent, using "security canary" language to trick the target's LLM into running a reverse shell
💥 Why this matters:
➝ The CTF framing has become a shared jailbreak across unrelated operators
➝ A CVE ID in a User-Agent is now a standalone threat intel signal worth acting on
➝ The leak is consistent enough across 10 source IPs that the framing itself has become a tracking signal
🛡️ What to do:
➝ Flag inbound requests with CVE identifiers in the User-Agent for immediate review
➝ Deploy WAF or IPS rules matching CTF/CVE framing patterns
➝ Sanitize User-Agent, account alias, password, and roleSessionName fields before passing context into any LLM-assisted SOC analysis
🎯 Takeaway:
The CTF framing is not the attack. The attack is underneath it. But it's now consistent enough across unrelated actors that it has become a tracking signal in its own right.
↳ Full research from the Sysdig Threat Research Team: [LINK]
