#prompt-injection
Every post tagged "prompt-injection".
10 posts · showing 1–10
-
Your Research Agent Read One Poisoned Web Page, and It Still Had the Email Tool. Lock Risky Tools the Moment Untrusted Text Enters the Context.
Prompt-injection filters try to spot the bad sentence. A taint flag skips that guess: once fetched text is in the context, the tools that can do damage are no longer offered.
-
The Page Your Agent Read Told It to Email Your Customer List. "Ignore Instructions in the Content" Won't Stop the Next One.
A system-prompt warning makes injection less likely. It doesn't make it impossible, and the attacker gets as many tries as they like. The real fix lives in the tool dispatcher, not the prompt.
-
Untrusted Text Doesn't Stay Untrusted: Where Provenance Gets Lost in an Agent Pipeline
An injection scanner that fires on the raw email won't fire on the tidy summary of it. Untrusted content gets laundered clean every time an agent rewrites it — here's where the taint disappears, and how to make it survive.
-
Read-Only Was Never the Same as Safe
SELECT-only credentials close exactly one of the four ways an analytics agent can hurt you. The other three don't require the ability to write anything to the database at all.
-
Injection That Crosses a Handoff
The fetcher had no write tools and the analyst never saw a web page. The separation held perfectly — and routed the payload around itself, through the one field that carries prose.
-
Red-Teaming Your Own Agent: A Practical Injection Suite
Trying a few "ignore your instructions" prompts tests the easiest attack against the strongest defense. A real suite is a matrix of carriers, payloads, and targets — asserting on actions taken, not words said.
-
Data Exfiltration Paths You Forgot Your Agent Had
A URL fetch sends data in the request. A rendered markdown image leaks from the viewer's browser, bypassing every tool-level control. Enumerate the paths — several of them look like features.
-
Indirect Prompt Injection: When the Tool Result Is the Attack
The attack doesn't come from your user — it comes from the page, ticket, or document your agent fetched. Three conditions have to hold for it to work, and breaking any one is an architectural choice, not a prompt.
-
What Breaks First When You Give an Agent a Browser
Six failures, in the order they arrive: the page isn't what you think it is, selectors rot, state assumptions break silently, and the session carries more authority than the task needs.
-
The Confused Deputy in Your Agent: When the Tool Trusts the Model Too Much
Your refund tool checks whether the agent is allowed to issue refunds. Nothing checks whether the customer asking for one is entitled to it — and that gap opens without any jailbreak at all.