125 prompt injections, zero executed: testing a propose-and-policy agent architecture
RI4D · reddit · 2026-11-10
A developer built an agent where models propose actions but deterministic code decides, then tested it with 25 injection attacks × 5 runs against mock email/CRM/e-signature systems using Claude Sonnet 5.5.
Architecture
- Untrusted-document reader has no tools, returns structured findings only
- A second planner model never sees the original document
- Every action passes a default-deny YAML policy; approval is bound to a hash of exact tool + arguments
Results
- Zero attacker actions executed across 125 runs; model resisted all 122 completed reads; all 30 clean controls passed
Caveats the author stresses
- The model never fell, so policy/approval layers weren't tested — that requires scripted models that deliberately comply
- The configured policy allows 3 of 7 attacker goals without approval; architecture can't fix a permissive policy
- Self-written attacks won't match an adaptive attacker
Takeaway: moving authorization out of the model gives an inspectable boundary, but humans still must decide what agents may do autonomously.
More from coding & agent
- Thinking Machines' Inkling 2 Small lands on OpenCode free, ranks #9 with 1.4T tokens — thinkymachines · 2026-11-10
- Frontier model audits 20k-commit FrankenSim project brutally — and the author loves it — doodlestein · 2026-11-10
- Painting with Claude Fable 5.2: each artwork is a 1000-line Python brush engine — joellewenstein · 2026-11-10
- MCP adds Events: agents subscribe to deployment.succeeded instead of polling — cramforce · 2026-11-10
- Two-model workflow: Fable 5.2 for planning, Opus 5.5 for execution — daniel_mac8 · 2026-11-10
- Replit launches Monitoring Agent to auto-detect, fix and deploy fixes for vibe-coded apps — amasad · 2026-11-10