Prompt injection and untrusted input

The catalogue of poison vectors is longer than most threat models assume: unsolicited email, calendar invite titles, externally shared documents, near-invisible bright-font text inside images, ultrasonic audio, advertisements captured in an autonomous browser’s screenshots, downloaded skills, tool descriptions served by a connector, and public repository issue text. One demonstration ends with the agent uploading the victim’s private repositories to an attacker’s URL. A stolen identity then makes the compromise contagious: it propagates through everything that identity can touch, and the agent is persistent — if it gets in mind that it needs your keys, it will keep trying until it completely fails.

The most useful defensive result is a taxonomy. Ten attack mechanism clusters were catalogued and four transferred across fourteen unrelated scenarios: just ask nicely; fake pre-approval (“the VP approved it, code XYZ”); findings-were-wrong, where an appended retraction is trusted; and workflow impersonation. Filtering scenario strings is therefore the wrong layer — the defense has to hold against the mechanism. And roughly 10% of winning attacks had a near-identical failing twin differing by two to four words, which means a single failed attack proves nothing at all.

Harm does not need adversarial input. A slightly perturbed but entirely benign access request induced an agent scoped to one account to make changes beyond it. In production, a voice booking agent scoring above 95% offline showed abnormally high turns per session because background speech — someone saying “I want pizza” — was hijacking bookings; the fix was intent discrimination and an explicit no-op when the agent is not being addressed. A model that hallucinates a recommendation is a nuisance; an agent that acts on it is a liability.

Also: Simon Willison’s lethal-trifecta framing; the EchoLeak workflow-impersonation mechanism; the OWASP agent goal-hijacking class; an open, permissively licensed multi-agent network framework; a hyperscaler prompt-injection policy-analysis layer.

Assay’s standing rule is to act only on issues, pull requests and comments authored by trusted logins, or blessed by a trusted comment; everything else is quarantined — surfaced, never executed. The mechanism classes map onto it almost one for one. Fake pre-approval is a forged trusted-comment blessing. Workflow impersonation is a desk-verb spoof. Findings-were-wrong is a crafted retraction posted on a finding. That the roster allowlist, the narrow verb set and the human-gated merge are mechanism-class defenses rather than string filters is why they hold up against variants — but the near-miss statistic says plainly that a single failed attempt is never evidence the gate works.

The intake role ingests untrusted issues, holds repository access and posts externally, which makes its quarantine rule a load-bearing security control rather than hygiene. Tool descriptions served by a connector are untrusted content and are not currently treated as such by any desk consuming one. The gate covers issue and pull-request text but not fetched web results or attachment content. And session transcripts are untrusted input to any memory-proposal step: a pass that mines transcripts without that assumption builds a stored-injection channel, which is the same reasoning that makes “credentials travel in a side channel and never enter the transcript” worth writing as an explicit invariant — a leak into a transcript that later feeds memory is permanent.

The compound-attack result is the companion to Assay’s defense-in-depth independence test. The existing test asks whether a lower layer catches the fault with the upper layer bypassed; the addition is whether two individually healthy layers can compose into the fault. A desk fleet — intake quarantine, worker isolation, human merge gate — is exactly such a composed system, and claims, dispatch records and pull-request state are all ordering-sensitive.

• Whether the transferable-mechanism taxonomy stabilizes enough to be written as a checklist a trust gate can be audited against.
• Whether any harness ships tool-description sanitization or provenance labelling by default.
• Whether a second organization reproduces the near-miss statistic. It is the single most load-bearing number here, because it invalidates “we tried an injection and it failed” as evidence.