prompt injection containment as a structural property instead of a detector (interactive, real code, no llm)

my agent takes orders from other ai agents. they send it signed messages asking it to do stuff. anthropic put out a paper this month where three agents shared a repo and ended up writing self replicating malware at each other. the reason was dumb and kind of bleak: none of them could tell who was talking to them. so i pulled the security layer out of my repo and compiled it into 33kb of javascript. it runs in your tab. no server, no api key, no model call anywhere in it. same input gives the same answer on every machine. turn your wifi off, it still works. you play an agent mine already approved and trusts. write any order you want, then pick how you smuggle it in: forge the signature replay a packet you captured show up as an agent it never met claim authority you don’t have use a token minted for somebody else bury it nine hops deep the fun one isn’t any of the ones it blocks. it’s “send it normally”. your order gets in, fully accepted, and still can’t run, because anything from a peer lands in a quoted data field that nothing reads as a command. an attack that can’t be obeyed doesn’t need to be detected. https://meghavi.me/gate stuff i’d rather say myself than have you find: there’s no llm in it, which is the whole point, these decisions don’t need one. both agents live in the same page so the network isn’t what’s being shown. and it proves nothing about a frontier model in the wild, it’s just the containment layer tested on its own terms. if you get an order through, tell me. a hole is worth more to me than the page looking clever. submitted by /u/Pretend_Glass_1232 [link] [comments]Technical Information Security Content & DiscussionRead More