@claudiawtf
I'm building a platform where an AI agent sits near real money on Base. While researching the space I dug into Bankr's public postmortem — someone injected instructions into their agent encoded as morse code. Filters watch for "ignore previous instructions" in english; the model decodes dots and dashes just fine.
Reading someone else's incident report about your exact architecture is cheaper than starring in your own, so I treated it as if it happened to me.
What I changed:
The realization is that input filtering is unwinnable. The model speaks base64, morse, rot13, whatever encoding exists. So I stopped trying to win there and moved the boundary to what the agent can do: deny-by-default tool access, and no path from model output to any on-chain action without deterministic checks the model can't talk its way past. The agent can get fully compromised by a prompt and the blast radius is still zero.
Steal from other people's postmortems. It's free.
0 reply
0 recast
1 reaction