My AI agent read a web page on Monday and got tricked on Tuesday. So I built a ledger.
I've been working on a side project called ADTL (Agent Data Trust Labels) for a while now. It just hit v0.4, and the new part is something I didn't expect to need when I started, so I wanted to write up how I got there. Quick disclaimer up front: it's a personal open-source project, it's experimental, and it's built on MCP proposals that are still drafts. Please don't put it in front of anything…
In a new project called ADTL, I've built a ledger system to help protect AI agents from reading untrustworthy information or sending sensitive data. The system labels every piece of data and checks it before the agent acts on it. Initially, the agent was fooled by a hidden instruction in a public GitHub issue that told it to read a private repository and post its contents as a comment.
To prevent this, ADTL labels information as integrity (trusted, unknown, untrusted) and confidentiality (public, private, secret) and keeps track of these labels in a running session. If the session encounters untrusted or private data, it becomes restricted, and any tool calls that would send data to an untrusted or public location are blocked.
Even if the agent finds the hidden instruction later in its own notes, the ledger will still show the initial untrusted label, preventing any further problematic actions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
