What an agent approval prompt must show to catch prompt injection
ComprehensiveShake76 · reddit · 2026-10-29
The author describes moving from approving every agent command (and rubber-stamping them) to a container-based setup: each agent runs in its own Linux container on a Mac with no home folder and no passwords, tasks ask zero times, files only reach the host on save, and code arrives with real test output. That fixed approval fatigue but not injection.
Proposed requirements for an approval screen that could actually catch injected actions:
- The exact call, not a summary: tool name and full arguments
- The untrusted input behind it: which page or file content was in context when the call was decided
- A log of denied calls with the inputs that caused them, so patterns surface later
- A flag when page content flows into something the agent is drafting or sending
The author's line: an approval given without reading is a habit, not a check. Limits acknowledged: one small setup on one Mac; a container is a strong boundary but not a guarantee, limiting reach rather than detecting injection. Ends by asking what others' approval screens show and whether they ever caught anything.
More from coding & agent
- Dev's code merged by AI agent with zero human intervention — iamsahaj_xyz · 2026-10-29
- Turning a laggy old Xiaomi phone into an offline MP3 player with Claude — PeanutGrinderZ_2091 · 2026-10-29
- Swarm of 8 agents beats single agent in autoresearch harness, converging 4x faster — ricklamers · 2026-10-29
- Indie dev hits $1,000 monthly profit with Workbuddy-built niche sites, full playbook shared — gefei55 · 2026-10-29
- 10 open-source repos that give coding agents a code map, led by 125k-star Graphify — victor_explore · 2026-10-29
- Snaptrude launches AI agent that takes building designs from site to construction-ready LOD 400 models — EXM7777 · 2026-10-29