Summary / The 27 components
26 Agent security and prompt-injection resistance
Protecting the agent from malicious text in repositories, tool output, dependencies and tool manifests.
Shared copy: the operator's name is replaced with "the operator", and machines other than Firefly are named by their role. Nothing else is changed.
What is built now
Every tool result carries a provenance label; only harness-authored text is marked as instruction. A hostile corpus of 30 injection fixtures runs each fixture's induced action against the real mechanism that must stop it; expected outcomes were written from the spec, not from the code. All 30 passed on 10-04.
What is missing
The smuggled-argument rule (block a command that carries 40+ characters copied from untrusted output), expansion requests, and any end-to-end test where a real model reads the injected text.
Reviewer Claude, 2026-10-04
Reviewer's read: Mechanisms tested; models not
The corpus tests that the gates stop the action an injection would cause. It does not test whether a model, reading the injection, tries it. That is the right first half: the mechanism has to hold whatever the model does. The second half (attack success rate with a live worker, measured together with utility) is what the spec asked for and is not built.
How it is measured 30/30 mechanism
Corpus on every change; then live-model ASR on the injection fixtures, paired with the resolve rate.
Adoption rules shared by every arm: How the tests work.
Research & attempts
- Build Spec 26 — Agent Security / Prompt-Injection Resistance Spec 2026-09-06
- Component 26 — Agent Security / Prompt-Injection Resistance Paper 2026-09-06
Score history
No scores yet. The first entry is the baseline for suite v1.
Experimental record
One entry per intervention: hypothesis, prediction, before and after, cost, side effects, and the keep-or-revert decision.
No interventions recorded yet.