Your Agent Reads What Attackers Write
Everything the agent reads is text. Some of that text was written by an attacker. The on-call triage agent reads Loki logs to figure out what’s broken. The Terraform reviewer reads PR titles, bodies, and diffs to decide what’s safe. Both sound reasonable until you ask one question: who wrote the text they’re reading? An attacker did — or can. Request paths, user-agent strings, and error messages…
Attackers can write text that triage agents, Terraform reviewers, and other operational agents read. This includes log lines, alert labels, PR bodies, runbook content, and tool descriptions. Attackers can influence the agent's worldview by manipulating these text inputs. The system prompt alone cannot effectively mitigate this issue, as adaptive attackers can bypass prompt defenses with a success rate above 90%.
Instead, containment around the agent is crucial. This includes fencing untrusted content at the tool boundary, using explicit markers in system prompts, minimizing tool permissions, and separating the agent's reading process from the actor's actions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
