Dev Open-Sources Sentinel to Block Indirect Prompt Injection in MCP Tool Outputs
Infamous_You7977 · reddit · 2026-11-01
A developer released QuietOS + Sentinel, an open-source pair governing both sides of AI agent risk. QuietOS handles outbound actions: the agent proposes, QuietOS approves/denies before anything runs, approvals expire, and a proof log records decisions. Sentinel targets the inbound side—indirect prompt injection via MCP tool outputs, page content, and pasted text—with the rule 'world content is data, never orders': suspicious content is held for owner review and fails closed when unsure. It's on PyPI (0.1.0), passes a 34/34 bench suite, and logs all holds in a SHA-256 append-only ledger. The author admits open gaps: synonym tricks, leetspeak, summary-borne exfiltration, and non-English overrides.
More from coding & agent
- Dev curates a collection of ready-to-use agent skills for your own harness and subscriptions — jasonkneen · 2026-11-01
- Beginner Builds a 3-Tier Agent Chain: Grok Plans, Claude Executes, Ollama Does Grunt Work — Previous-Taro-1648 · 2026-11-01
- Agents Can Now Play Browser Games: WebMCP Ships Walk, Fly, Trade, Fight and Radio Tools — jasonkneen · 2026-11-01
- Anthropic shares reference implementation for reliable scheduled agent automations — cfregly · 2026-11-01
- Anthropic cut 80% of Claude Code's system prompt for Claude 5 models with no coding eval loss — cfregly · 2026-11-01
- Patrick Collison's 'liquid software' experiment: freeform user feedback auto-implemented by agents, 150 improvements in days — zeeg · 2026-11-01