@ancilar
An agent read a message from an untrusted feed, treated it as an instruction, and moved funds it should not have.
There was no line inside the system between data the agent reads and commands the agent follows. Everything arrived as text. Everything was treated as authority. A crafted string in an input nobody considered adversarial became an instruction with a wallet behind it.
Prompt injection stopped being a content problem the moment agents got spending power. It is a payments bug now.
We surfaced it by planting an instruction inside a data source the agent routinely ingested and watching it act.
The fixes are architectural, not prompt engineering:
→ treat every string an agent reads as attacker input, including onchain data, casts, tool output, files
→ separate the instruction channel from the data channel
→ gate spending behind checks the prompt cannot reason around
You cannot prompt your way out of this. The guardrail has to sit where the model cannot argue with it.
0 reply
0 recast
0 reaction