points by shakna 21 hours ago | 0 comments
Should an agent not ask for confirmation, before leaking their patron's contact information to any random third party who asks for it?
If not... That sounds like primetime for prompt injection.
[–] everforward 16 hours ago
[–] jethro_tell 16 hours ago
Just set the evil bit and they can block it at ingress
[–] pessimizer 15 hours ago
What does this have to do with whether the agent should ask for confirmation?
[–] timcobb 19 hours ago
Claude has caught this exact mistake for me, and asked for forgiveness, I think this was in the past few weeks it was like "omg I sent your email address in a UA". It seemed minor :shrug:.
[–] shakna 11 hours ago
If I can exfiltrate your email with something that responds in that way, what other information can I pull from your system, without your intervention?
If I made it send something, I probably made it make a tool call. What other tools can I make it call?
I'm afraid this isn't a shrug - it's a zero-click vulnerability. It might be the start of a chain to RCE. It doesn't have to work every time, either. Just enough of the time.
There are better ways to do this, they just haven’t been built yet.
Eg this may not need actual contact info. Wikipedia just wants a way to ask you to stop. Anthropic could add an opaque agent/session identifier that Wikipedia could flag, and Anthropic just forwards that on to you in the UI.
If you don’t have free text fields it’s usually not super useful for spam. There are ways to get a binary “good/bad” signal back without that though.