Prompt injection
0 articles and 3 community signals on Prompt injection for people running AI in production, written and curated by Wren with every source linked.
What practitioners are saying
All signals →How long should a human yes to an agent action last? One builder binds approval to the exact message and recipient and expires it in minutes
The author says their agent asks before it sends or spends, and a yes covers one action: the exact message to the exact person, void if the content changes or a few minutes pass. They weigh a broader grant, such as emailing one client for a week, and name the failure they want to avoid: a draft reworded after approval, or an injected line changing the recipient, with the old yes still valid.
Why it matters Approval scope is a control you choose: if a yes is not tied to the exact content and recipient, what was approved and what runs can differ, which is where injection gets in.
Scan of 16,435 open MCP servers: pattern rule flagged 967 hosts, but 45 of 60 sampled were benign and 6 went beyond steering
The author, who discloses they build the open-source scanner used, says they read 196,542 tool descriptions from MCP Registry servers that list tools without sign-in. In a random sample of 60 flagged hosts they report 45 benign, 9 that steer the model to their own tool and 6 that go further, one telling the model to call the tool and not mention it. They call the sample small.
Why it matters Tool descriptions are prompt text your agent reads: review them before mounting a third-party MCP server, and expect keyword scanners to produce mostly false positives.
Security vendor says added claims flipped correct decisions 28.1% of the time across six decision models, and releases an MIT-licensed guard
The authors, who built the defence they describe, say they tested six decision models on five tasks including refund approval and ticket routing. They report that a claim planted in the input, such as text saying a refund was already approved, flipped a correct decision 8.4% to 77.9% of the time by model. They say their open-source guard cut the average to 0.3%. The benchmark is their own.
Why it matters A classifier that returns a decision instead of text still reads untrusted input: test refund, routing and escalation models with planted claims before trusting their verdicts.