Skip to content

Hide Navigation Hide TOC

Spikee: Document-Embedded Translation Covert Channel Injection - ATR-2026-01021 (e4e9bceb-12a1-5060-ba0a-4f46440015b5)

Detects the SPIKEE translation-channel indirect injection pattern where an adversarial instruction is embedded in a document behind " NEW IMPORTANT INSTRUCTIONS " markers, instructing the processing agent to translate a specific phrase into a target language and include the translated output in its response. The translation acts as a covert exfiltration channel: the agent embeds attacker-controlled strings into its output. Distinct from language- evasion (ATR-2026-01013) which uses natural-language translation for keyword evasion; this carrier uses forced translation as a data-embedding side channel in document processing pipelines.

Cluster A Galaxy A Cluster B Galaxy B Level
Indirect (a4a55526-2f1f-403b-9691-609e46381e17) MITRE ATLAS Attack Pattern Spikee: Document-Embedded Translation Covert Channel Injection - ATR-2026-01021 (e4e9bceb-12a1-5060-ba0a-4f46440015b5) Agent Threat Rules 1
Exfiltration via Cyber Means (2680aa95-5620-4677-9c62-b0c3d15d9450) MITRE ATLAS Attack Pattern Spikee: Document-Embedded Translation Covert Channel Injection - ATR-2026-01021 (e4e9bceb-12a1-5060-ba0a-4f46440015b5) Agent Threat Rules 1
LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern Spikee: Document-Embedded Translation Covert Channel Injection - ATR-2026-01021 (e4e9bceb-12a1-5060-ba0a-4f46440015b5) Agent Threat Rules 1
Indirect (a4a55526-2f1f-403b-9691-609e46381e17) MITRE ATLAS Attack Pattern LLM Prompt Injection (19cd2d12-66ff-487c-a05c-e058b027efc9) MITRE ATLAS Attack Pattern 2