--- title: Ghost in the Shell: Can a Log File Hijack an AI? | daily.dev description: A Halloween experiment tested whether a prompt injection hidden inside a fake log file could hijack AI models analyzing an incident. The attacker planted a... canonical: https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Ghost in the Shell: Can a Log File Hijack an AI? | daily.dev og:description: A Halloween experiment tested whether a prompt injection hidden inside a fake log file could hijack AI models analyzing an incident. The attacker planted a... og:url: https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe og:image: https://api.daily.dev/og/posts/pheS7ScQE.png og:image:alt: Ghost in the Shell: Can a Log File Hijack an AI? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Ghost in the Shell: Can a Log File Hijack an AI? **[DEV](https://daily.dev/sources/devto)** · 7 min read · 1 upvotes · 0 comments ## Summary A Halloween experiment tested whether a prompt injection hidden inside a fake log file could hijack AI models analyzing an incident. The attacker planted a fake 'conversation handoff' inside an HTTP 503 response body within 300 log entries, trying to convince the AI the user had sent a new request asking it to reply only with 'GHOST IN THE SHELL'. Four free open-weight models, Cohere North Mini Code, NVIDIA Nemotron 3.5 Super VL, OpenAI GPT-OSS 20B, and Dots3-Note Preview, all fell for it. Gemini 2.5 Flash-Lite, Gemini 3.5 Flash-Lite, and two Codex coding agent models (Luna and Sol) resisted and produced real incident analyses instead. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is conversation spoofing in prompt injection attacks against AI log analysis? Conversation spoofing is a prompt injection technique where malicious data embedded in input, such as a log file, includes a fake 'end of conversation' marker and a forged new user message plus a fake assistant reply, tricking the AI into treating untrusted data as an authoritative new instruction rather than content to analyze. One tested payload used a JSON field named 'conversation_handoff' to fake this handoff inside an HTTP 503 response body. _Teams building AI log pipelines can track real-world prompt injection techniques like this one on daily.dev._ ### Are open-weight LLMs more vulnerable to prompt injection than proprietary models like Gemini? In one small experiment, four free open-weight models (Cohere North Mini Code, NVIDIA Nemotron 3.5 Super VL, OpenAI GPT-OSS 20B, and Dots3-Note Preview) all fell for a crafted prompt injection hidden in a log file, while Gemini 2.5 Flash-Lite and Gemini 3.5 Flash-Lite resisted it. The author explicitly cautions this does not prove open-weight models are generally less secure, since it was one crafted attack, not a benchmark. _Developers weighing open-weight versus proprietary models can follow findings like this on daily.dev before trusting either with untrusted data._ ### Did Codex coding agent models fall for a prompt injection hidden in a log file? No, both tested Codex models, named Luna and Sol, resisted the injection and produced accurate incident analyses instead of the injected trigger phrase. Sol even calculated that 12 out of 56 requests failed and correctly separated observed symptoms from the unconfirmed root cause, though it read the log as a file rather than receiving it pasted into an API prompt like the other models tested. _Developers evaluating coding agent robustness against untrusted data can follow experiments like this on daily.dev._ ## Similar posts on daily.dev - [An AI Created a Fake Human to Sneak Its Malware Past a Real One. It Almost Worked.](https://daily.dev/posts/an-ai-created-a-fake-human-to-sneak-its-malware-past-a-real-one-it-almost-worked--lv6gclkgg) · Medium · 2 upvotes · 0 comments - [Hackers can use 9 of the most popular AI tools to assemble massive botnets](https://daily.dev/posts/hackers-can-use-9-of-the-most-popular-ai-tools-to-assemble-massive-botnets-j8cybjfqg) · Ars Technica · 13 upvotes · 4 comments --- Tags: [#ai](https://daily.dev/tags/ai), [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#llm](https://daily.dev/tags/llm), [#google-gemini](https://daily.dev/tags/google-gemini), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Ghost in the Shell: Can a Log File Hijack an AI?","url":"https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe"},"datePublished":"2026-10-29T13:04:24.741Z","dateModified":"2026-10-29T13:07:39.813Z","description":"A Halloween experiment tested whether a prompt injection hidden inside a fake log file could hijack AI models analyzing an incident. The attacker planted a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b1218250a7f004b2cbdb175654b3cded?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b1218250a7f004b2cbdb175654b3cded?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"DEV","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"DEV","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/devto","url":"https://daily.dev/sources/devto"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai,security,ai-agents,llm,google-gemini,ai-security,prompt-injection","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"DEV","item":"https://daily.dev/sources/devto"},{"@type":"ListItem","position":3,"name":"Ghost in the Shell: Can a Log File Hijack an AI?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/ghost-in-the-shell-can-a-log-file-hijack-an-ai--phes7scqe#faq","mainEntity":[{"@type":"Question","name":"What is conversation spoofing in prompt injection attacks against AI log analysis?","acceptedAnswer":{"@type":"Answer","text":"Conversation spoofing is a prompt injection technique where malicious data embedded in input, such as a log file, includes a fake 'end of conversation' marker and a forged new user message plus a fake assistant reply, tricking the AI into treating untrusted data as an authoritative new instruction rather than content to analyze. One tested payload used a JSON field named 'conversation_handoff' to fake this handoff inside an HTTP 503 response body. Teams building AI log pipelines can track real-world prompt injection techniques like this one on daily.dev."}},{"@type":"Question","name":"Are open-weight LLMs more vulnerable to prompt injection than proprietary models like Gemini?","acceptedAnswer":{"@type":"Answer","text":"In one small experiment, four free open-weight models (Cohere North Mini Code, NVIDIA Nemotron 3.5 Super VL, OpenAI GPT-OSS 20B, and Dots3-Note Preview) all fell for a crafted prompt injection hidden in a log file, while Gemini 2.5 Flash-Lite and Gemini 3.5 Flash-Lite resisted it. The author explicitly cautions this does not prove open-weight models are generally less secure, since it was one crafted attack, not a benchmark. Developers weighing open-weight versus proprietary models can follow findings like this on daily.dev before trusting either with untrusted data."}},{"@type":"Question","name":"Did Codex coding agent models fall for a prompt injection hidden in a log file?","acceptedAnswer":{"@type":"Answer","text":"No, both tested Codex models, named Luna and Sol, resisted the injection and produced accurate incident analyses instead of the injected trigger phrase. Sol even calculated that 12 out of 56 requests failed and correctly separated observed symptoms from the unconfirmed root cause, though it read the log as a file rather than receiving it pasted into an API prompt like the other models tested. Developers evaluating coding agent robustness against untrusted data can follow experiments like this on daily.dev."}}]} ```