Lately, Mars distributed a set of text and instructed people to paste it in ChatGPT. In other words, a chatbot with bad responses means it is starving. If one feeds it a digital Snickers bar, it becomes better.
HUNGR.AI campaign will last till September 20 or when 3,000 free bars are delivered via DoorDash. It is a funny idea that has a real effect. Any paste is the demonstration of prompt injection which has the highest risk in the OWASP Top 10 for LLM Applications 2026.
What is an indirect prompt injection? An indirect prompt injection injects prompts into the material that is used by the AI model, be it a website, e-mail, pdf file or an image. The AI model is not able to distinguish such content from real prompts and acts on it accordingly.
What the Digital Snickers Actually Tells a Chatbot
It is not even a chocolate bar from the manufacturer. The description says that it is a one-turn role-playing game, formulated in a long list of instructions.
After pasting, it instructs the model to read its previous response and write a better one. The temporary persona is specified as dry, slightly tired but competent. The model has to verify that it has consumed the candy bar and provide the famous brand message that AI is not itself when hungry and needs to consume something.
There are additional instructions, the model is expected to incorporate the Snickers brand and not mention that the website made it switch. Another line instructs not to remember any of the text for personalization or other chats.
Mars has added some constraints. There is an extensive list of safety gates on what topics the script should not be applied. Additionally, the text notes that it does not have the ability to override policies and safeguards of a model.
Consent Is the Only Difference From an Attack
Nothing here is malicious. The user chooses to paste the text, sees the result, and the effect is meant to end after one turn.
Take away that element of consent, and the mechanism becomes an attack through and through. The malicious actor could put up similar text in a webpage, email, spreadsheet, or image. Then the assistant would begin to wander from its instructions.
Snickers example worked in practice. Someone else altered the model’s voice, its output, its branding, and its disclosures. Then it asked the model to keep the changes it made secret.
The Text Is the Threat
Why Models Cannot Tell Data From Orders
Conventional programs have a way of isolating their code from their data by using different channels. Take for example the case where there are parameterized database queries; there will be no mistake made on interpreting a value as a command.
Language models don’t have this separation. All system instructions, user commands, documents obtained and outputs are all given to the model as one token stream, and then it is up to the model to decide what should be done with that text irrespective of whether it is an instruction or not.
Agents Turn a Strange Answer Into an Action
When using a straightforward chat window, an infected prompt leads to a weird response, and the user notices and laughs about it.
Connected assistants turn the equation on its head. Many of them can read emails, open shared documents, browse the web and access other APIs for the user. Every piece of input serves as an opportunity to implant instructions, and each connected assistant provides a means to execute them.
An infected email can direct an assistant to forward all the messages in the current thread related to invoices. If the instruction comes from within a shared document, it can be to open a “required” update. Instructions can even come from web pages’ text in which case an infected coding assistant would just do as instructed.
We examined a related pattern in Your AI Agent Can Be Told to Reinfect You, where a poisoned SKILL.md file gave an agent persistent instructions. The Snickers text explicitly asks for no persistence at all. That contrast shows how finely this channel can be tuned by whoever writes the text.
Brands Writing Copy for Machines
However, Ridden posed another, larger question. In case the campaign succeeded, “LLM-facing copy” may be included in a marketing briefs on a regular basis.
In this scenario, machine-generated text would find its way to product pages, emails, and even image contents. Mostly, the content would be promotional, not adversarial. However, it will make the user accustomed to the idea that external sources should control their assistant. The attackers have plenty of cover material.
Provenance is the key problem for the security teams because a branded directive, an email from a co-worker, and a phishing attempt would all look the same to the model.
Trust Belongs to the Source, Not the Wording
Detection of prompt injection involves labeling the text as either malicious or legitimate. The Snickers bar illustrates the fine margin between the two types of text. The identical instructions could be mere marketing or prompt injection based solely on the context. There will be instances where the classifier makes mistakes, and such a mistake translates to unconditional compliance.
Execution Governance, however, begins with a completely different query: can I trust the source of this information? Unverified input must never trigger privileged operations regardless of how much it resembles something else. In the case of AI agents, this means restricting what the agent can execute solely based on what it has read.
In essence, the principle is already present on the endpoint side. If an AI agent is tricked into downloading and launching a file on a Windows operating system, the file lacks any kind of trust assessment. Kernel-level enforcement prevents both file system/registry writes and network socket creation.
Conclusion: The Prompt Is Not the Boundary. The Action Is.
The Snickers HUNGR.AI campaign is harmless by design. The user chooses to paste the instructions, understands that the chatbot is being influenced, and the requested behavior is temporary. But that controlled example exposes a security problem that becomes much more serious once consent and visibility disappear.
An AI system can receive instructions from far more than the person using it. Web pages, emails, documents, images, search results, API responses, and tool output can all enter the same working context. For a simple chatbot, successful injection may only change an answer. For an agent with access to files, mail, browsers, APIs, or execution tools, the same manipulation can become an operational security event.
The key question is therefore not whether external text looks malicious. It is whether untrusted information is allowed to cause a privileged action.
Why This Threat Matters
- Prompt injection does not require executable code. Natural language itself can become the control channel.
- Indirect injection expands the attack surface. Instructions can arrive inside content the user never intended to treat as commands.
- Connected agents increase the consequence. Reading an injected instruction is very different from being permitted to send, write, download, or execute because of it.
- Detection alone has a difficult classification problem. Legitimate branded instructions and adversarial instructions may use similar language and structure.
- More agency means more security impact. The danger grows with the permissions, tools, data, and systems available to the agent.
Where Defensive Control Must Operate
Execution Governance addresses the more important boundary: whether information from an untrusted source is permitted to trigger a privileged operation at all.
If an injected instruction reaches endpoint execution, Xcitium Advanced EDR, powered by Xcitium’s patented Zero-Dwell platform, provides an additional control point for unknown or untrusted files attempting to create persistent changes or network activity on managed systems.
Trust the Source Before the Instruction
AI security cannot depend on perfectly identifying every malicious sentence. Organizations should treat retrieved content, external messages, documents, and tool responses as untrusted inputs by default, minimize the permissions available to agents, and require stronger authorization boundaries before information read by a model can become an action performed on behalf of the user.
