Do these prompt injections work in the places this test placed them? (tool output)
I have my agents read other instruction files and they don't seem to get affected by the instructions found after a read/bash tool call. Curious if any analysis has been done to see if older prompt injection data sets are even effective anymore.
The whole thing looks heavily agent generated, my trust in them is not very high, how has this been validated or verified by a human?
(side note, it seems my 'no emoji' system prompt line works really well, I forget how obsessed they can be with emojis)
I'm personally setting up to instead use a policy tuned agent on the tool calls themselves (rather than the output), so it never gets run if it has things that it shouldn't be doing. Mainly because they insist on working around instructions that say "don't" or permissions that restrict tools (eg: "git push": "deny" - where they just put the command in a script and run it there, bypassing hard checks)
Feels like detection at the wrong layer. The injection is text but the damage is a tool call, so the thing worth constraining is which tools the agent can reach and under whose permissions. A detector at 95% still passes one in twenty straight through to an unconstrained tool.
Do these prompt injections work in the places this test placed them? (tool output)
I have my agents read other instruction files and they don't seem to get affected by the instructions found after a read/bash tool call. Curious if any analysis has been done to see if older prompt injection data sets are even effective anymore.
The whole thing looks heavily agent generated, my trust in them is not very high, how has this been validated or verified by a human?
Should we expect a magic solution in the near future? https://github.com/rudratoshs/taintgate
(side note, it seems my 'no emoji' system prompt line works really well, I forget how obsessed they can be with emojis)
I'm personally setting up to instead use a policy tuned agent on the tool calls themselves (rather than the output), so it never gets run if it has things that it shouldn't be doing. Mainly because they insist on working around instructions that say "don't" or permissions that restrict tools (eg: "git push": "deny" - where they just put the command in a script and run it there, bypassing hard checks)
Very cool. Did you try any majority vote or some other kind of technique to combine several of them and maybe achieve better results ?
Feels like detection at the wrong layer. The injection is text but the damage is a tool call, so the thing worth constraining is which tools the agent can reach and under whose permissions. A detector at 95% still passes one in twenty straight through to an unconstrained tool.