indirect prompt injection

Map the author, entry route and executing identity. Compare two fictional systems using reachable consequences, then explain what evidence could reverse your judgment.

Map each control to a specific read, operation or release. Check policy inputs, audience permissions, verdict timing and useful work instead of relying on defense labels.

Use the historical EchoLeak advisory and an original worked trace to distinguish delivery, actual exposure, generated output and release. Choose verifiable controls without implying the old vulnerability remains open.

Follow individual fields from their authors through tools, summaries and actual model exposure. Separate service-authoritative identifiers from quoted prose, then check each output and operation.

Poisoning a knowledge base is cheaper than poisoning a model. The answer that scores starts from who can write to the corpus and limits what a poisoned chunk can achieve.

Trace which private data can reach which destinations when browsing and email share a task. Rank harms by the capabilities and checks actually present, and preserve useful combined workflows within a narrow grant.

Trace field origin through telemetry, summaries and response proposals. Preserve evidence, verify current targets and playbooks, and test both missed threats and harmful containment.

Choose narrow extraction or full-text reading according to the task. Preserve source evidence and uncertainty, and enforce data audiences and action authority independently of extracted claims.

Preserve the source and limits of each signal, verify model claims and bind response actions to exact targets. A passing authentication result does not prove benign mail.