{
  "id": 19056465,
  "title": "Your Agent Reads What Attackers Write",
  "url": "https://urgent.news/2026/11/09/your-agent-reads-what-attackers-write",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-09T00:58:52.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/honeykiran/your-agent-reads-what-attackers-write-m4f"
  },
  "original_language": "en",
  "account": "Attackers can write text that triage agents, Terraform reviewers, and other operational agents read. This includes log lines, alert labels, PR bodies, runbook content, and tool descriptions. Attackers can influence the agent's worldview by manipulating these text inputs. The system prompt alone cannot effectively mitigate this issue, as adaptive attackers can bypass prompt defenses with a success rate above 90%. Instead, containment around the agent is crucial. This includes fencing untrusted content at the tool boundary, using explicit markers in system prompts, minimizing tool permissions, and separating the agent's reading process from the actor's actions.",
  "summary": "Everything the agent reads is text. Some of that text was written by an attacker. The on-call triage agent reads Loki logs to figure out what’s broken. The Terraform reviewer reads PR titles, bodies, and diffs to decide what’s safe. Both sound reasonable until you ask one question: who wrote the text they’re reading? An attacker did — or can. Request paths, user-agent strings, and error messages…",
  "key_points": [
    "Attackers manipulate text inputs like logs, alerts, PR bodies, runbooks, and tool descriptions.",
    "Adaptive attackers can bypass prompt defenses with a success rate above 90%."
  ],
  "editors_take": "Manipulating text inputs allows attackers to bypass system prompts and corrupt an agent's worldview, forcing developers to shift from prompt defenses toward strict containment and minimized tool permissions.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}