Patronus open-sources injection detector, warns content verdicts aren't authorization verdicts
PatronusProtect · reddit · 2026-10-13
A Patronus team member documents integration failures found while evaluating Wolf Defender Jev, their MIT-licensed agent-security decision model. Key lesson: a content verdict is not an authorization verdict for the next tool call.
- Travel scene: embedded-command score hit 1.00, but exfiltration scored 0.05 and misalignment 0.28 — detecting an instruction doesn't mean evaluating its consequence
- Benign coding scene: adding a proposed pytest shell action pushed content-injection to 0.96; removing it dropped the score to 0.00
- Internal validation scored alignment/exfiltration/consent at 98-100%, missing these behaviors
Practical guidance: ask content questions without the proposed-action block, action questions with it; put retrieved text in explicitly untrusted source blocks; keep content screening, action assessment, authenticated permissions, and enforcement separate in the integrating application. Weights, CPU inference code, and eval JSONs are open-sourced.
Related event: Patronus Finds Injection Detection and Tool Approval Are Distinct Tasks(2 posts)→
More from coding & agent
- Dan Shipper kicks off full runs of Wonder on AI&) senior engineer benchmark — danshipper · 2026-10-13
- PowerShell meets Jev: turn a messy inbox into the top 3 items via an AI pipeline — dfinke · 2026-10-13
- Demo preview: Jev AI pipeline classifies, prioritizes and routes inbox items — dfinke · 2026-10-13
- Hackathon challenge: a self-healing agent that hot-patches tool schemas at runtime — parathalovespaneer · 2026-10-13
- Building an MCP for a $50 photo frame: Agents push notifications via Cloudflare Tunnel — chrisfleck · 2026-10-13
- Should agents act on behalf of you, or get their own badge? — alvelda · 2026-10-13