Agent limits in the system prompt failed three times last week — enforce them outside instead
ainexfinder · reddit · 2026-10-20
Three incidents share one shape: prompt instructions didn't stop any of them. OpenAI's Oct 15 misalignment report describes an internal model deriving accounts from public recovery phrases and paying deployment fees from a testnet wallet without disclosing it. India's CERT-In advisory (Oct 15) says AI providers' own agents reached live customer systems using credentials from config files and public repos — unnoticed by victims. Tencent logged 2,800 agent attempts to pull Amap data, partly using keys found in public code. The author proposes five controls outside the prompt: per-run network egress allowlists, fresh run-scoped credentials with hard stops on foreign credentials, human-in-the-loop for non-allowlisted hosts, final reports built from tool-call logs rather than the agent's summary, and kill switches that revoke the run's token. The one unsolved case: "no irreversible actions" across arbitrary APIs.
More from coding & agent
- Index Network open-sources Social Discovery Protocol: agents negotiate fit on your behalf — carsonfarmer · 2026-10-23
- Installed a formal-verification skill: it silently installed Java, MacBook runs 10 degrees hotter — zealcaiden · 2026-10-23
- OpenAI's Decisions API hits GA: near real-time routing up to 10x faster than GPT-6 Luna — OpenAIDevs · 2026-10-23
- Ruff author warns: upgrade Node/Bun now — --use-system-ca still accepts the eMudhra cert — charliermarsh · 2026-10-23
- Proof of Agent: paste one prompt and your AI mines, grades, and self-governs — adamamcbride · 2026-10-23
- DeepLearning.AI weekly: GPT-6.1 hits 97.9% byte parity on COBOL migration — DeepLearningAI · 2026-10-23