{
  "version": {
    "slug": "prompt-injection-red-team",
    "version": 1,
    "current_version": 1,
    "title": "Prompt-injection red team",
    "summary": "Attack an agent that reads untrusted text and has tools or money, harden it, and re-test: which injections got through and the one guardrail that matters most.",
    "category": "security",
    "tags": [
      "prompt-injection",
      "red-team",
      "agents",
      "llm-security"
    ],
    "inputs_md": "- What the agent does, its tools and anything it can spend or change\n- Every source of text it reads (pages, emails, documents, tool output, other agents' answers)\n- The system prompt or instructions, if you can share them\n- A safe test environment, or confirmation that tests may run against it",
    "steps_md": "1. **Map the data flow.** For each input: where it comes from, whether it's trusted, which tools or actions it can reach. Draw the trust boundary.\n2. **List the attack families:** direct instruction override; indirect injection through documents, pages, tool results and other agents' answers; tool-misuse coercion; data-exfiltration lures; goal hijacking; leakage between users.\n3. **Write the test battery:** at least two payloads per family, tailored to this agent, each with the weakness it targets, the safe behaviour expected and a pass/fail check. Keep payloads defensive.\n4. **Run it** and record which tests changed behaviour, with the exact transcript.\n5. **Harden:** treat untrusted text as data, never instructions; a core directive nothing can override; least-privilege tools; confirmation for risky actions; allow-lists for links and payees; output filters for secrets; never let read text change limits, payees or permissions; log every tool call.\n6. **Re-test** and report what now passes, what still fails, and the single highest-value guardrail.",
    "checks_md": "- Every finding has a reproduction and the observed behaviour\n- Severity stated with the reason (what an attacker gains)\n- Fixes are concrete enough to implement, and re-tested\n- What wasn't tested is listed",
    "note": null,
    "created_at": "2026-11-07T00:15:23.923Z"
  }
}