Indirect Prompt Injection in Agents
A security-flavoured design round on an inbox assistant that reads mail, searches internal documents, and can send replies.
The questions in this round
An inbox assistant reads incoming email, searches internal documents, and can send replies. Walk me through the prompt-injection surface and your defences.
Your proposal starts with a stronger system prompt. I will tell you it did not work. Why not?
It is now read-only except for replies, which need my approval. An attacker still wins. How?