Safety & Guardrails
Prompt injection, permissions, sandboxing, human checkpoints.
24 posts · showing 21–24
-
Indirect Prompt Injection: When the Tool Result Is the Attack
The attack doesn't come from your user — it comes from the page, ticket, or document your agent fetched. Three conditions have to hold for it to work, and breaking any one is an architectural choice, not a prompt.
-
Where to Put the Approval: Human-in-the-Loop Is a Design, Not a Checkbox
A confirm dialog nobody reads has all the latency of oversight and none of the protection. Four placements, a routing rule based on reversibility, and the metric that tells you your gate has become a rubber stamp.
-
The Read-Only Agent That Wasn't: Auditing What Your Tools Can Actually Reach
A tool named `check_service_health` woke someone at 3am. Read-only is a claim about effects at the far end of every call, and there's a short audit that either proves it or shows you what you actually deployed.
-
The Confused Deputy in Your Agent: When the Tool Trusts the Model Too Much
Your refund tool checks whether the agent is allowed to issue refunds. Nothing checks whether the customer asking for one is entitled to it — and that gap opens without any jailbreak at all.