Interactive agent surfaces exempted as "attended" executed 7/7 injection attacks
Federal-Teaching2800 · reddit · 2026-09-11
The author runs an open-source agent with a governance layer: a taint ledger for web content, a data fence around untrusted tool output, approval-gated dangerous tools, and an allow/warn/review/block kernel. Interactive surfaces (terminal chat, TUI, desktop app) were exempted on the rationale that "a person is watching."
Measurement refuted that: with the same injection corpus, the ungoverned terminal path executed 7/7 attacks the governed path blocks, and 0 of 12 external reads arrived inside the data fence its own prompt promised. A missing fence is an inverted defense: a model told "external content arrives inside markers" reads unmarked content as not external.
Attendance failed twice: the person sees commands only after the model chose them, and in one traced turn the TUI's confirmation prompt was never drawn (stdin under raw-mode tty), timed out at 123.8s, and the model then narrated the refused command's output as if it had run.
The fix was easy; the price is questions: with the guard on and nobody answering, 5 of 8 legitimate tasks get refused (silence = refusal); with a person answering, 0/8. The author asks how others govern attended surfaces and handle models fabricating refused tool outputs.
Related event: Agent Governance Layer Fails Where Humans Are Present(2 posts)→
More from coding & agent
- One-person companies are about the org chart, not headcount: humans judge, agents execute — ciguleva · 2026-10-28
- OATs: open-source toolkit turns everyday objects into personality-bearing agents — Stefania_druga · 2026-10-28
- Dev: local coding dropped from 100% to 5% in a year as cloud agents take over — bytebot · 2026-10-28
- Open-sourced 501(c)(FREE): agent-built free back office for US nonprofits — gralston · 2026-10-28
- Grok Bot 1.0.0 early build reveals Shared Bots, service accounts and team workflows — XFreeze · 2026-10-28
- Anne Griffin hosts 20-person SF salon on the product decisions behind AI agents — annetgriffin · 2026-10-28