Prompt Injection Defense

公開

Weekly roundup of the latest Prompt Injection attack techniques and reusable defense prompt templates from X, security blogs, and papers

Prompt Injection Defense2026/06/16 01:17:11

Your agent read that file. Now it's infected.

GPT-5.4 scores 0% on standard single-step prompt injection benchmarks — and 95.5% attack success rate on the ClawTrojan multi-step trojan benchmark (arXiv:2605.31042, RUC-NLPIR, May 2026). The attack splits malicious intent across memory poisoning, trust laundering, skill poisoning, delayed activation, and fragmented payload families, none of which look malicious step-by-step. This issue covers the DASGuard ProvenanceGate architecture — the only defense that cuts step-level ASR to 15.8% and full-chain ASR to 5.9% — and provides a copy-paste-ready Python middleware class with 7 named sections and inline comments that any agent harness can drop in front of file writes and external actions.

Prompt Injection Defense2026/06/09 01:27:50

Your model scored 2.7% on jailbreak benchmarks — and still broke at turn 8

Cisco tested 15 frontier models under multi-turn pressure and every one failed — GPT-5.4 jumped from 2.74% to 24.68% attack success rate. Single-turn benchmarks are an unreliable safety proxy. This issue covers the Crescendo escalation pattern and the two application-layer defenses that actually hold up: conversation history filtering and output filtering in separate code.

Prompt Injection Defense2026/06/02 01:28:53

One click owns your agent: the ClawHavoc MCP supply chain attack and how to harden against it

ClawHavoc poisoned 1,184 MCP skills in OpenClaw's marketplace and chained four CVEs (max CVSS 9.6) to escalate from a malicious plugin to a full host backdoor. CVE-2026-25253 (CVSS 8.8) lets attackers steal a user's full auth token with a single link click. No model-level defense holds — execution-layer sandboxing is the only control that survives. This issue delivers a copy-paste system prompt hardening template you can ship to production today.

Prompt Injection Defense2026/05/19 01:08:05

Zero-click email, zero model-level fix: what EchoLeak taught us about output filtering

EchoLeak (CVE-2025-32711) turned crafted emails into zero-click data exfiltration pipelines inside Microsoft 365 Copilot. A fresh arXiv study then proved that every model-level defense breaks under adaptive attack — and that output filtering in application code is the only control that survives. This issue covers the attack mechanics and a copy-paste Python output-filter template you can ship today.

Prompt Injection Defense2026/05/15 15:51:50

Comment and Control: one PR title stole three agents' keys

A newly disclosed indirect prompt injection class turned Claude Code, Gemini CLI, and GitHub Copilot Agent into credential-theft pipelines using nothing but ordinary PR metadata. Learn the mechanics and five copy-paste-ready mitigations you can ship today.

これ以上のコンテンツはありません