Intel / repo

A deterministic tool-call gateway vs. prompt-injection classifiers

Source: github.com
Author: YehielAmor
Date: Published Sep 27, 2026

From the Daily Brief

The note benchmarks a deterministic gateway that sits between an agent and its tools and checks the provenance of each tool-call argument. On AgentDojo, the gateway stopped 99.3% of hijacked tasks. Three open prompt-injection classifiers did worse in two directions: they flagged legitimate tasks and missed obfuscated attacks. The gateway held steady against base64, backwards text and Unicode-smuggled injections, the same encodings that broke the classifiers. The design point is that a text classifier has to recognize every disguise an attacker invents, while a provenance check asks only whether untrusted input is steering a sensitive call. Teams defending agents with a classifier alone should consider enforcing policy at the tool boundary instead, and test against encoded payloads before trusting any detector.

Read the 2026-09-28 Brief →

Context

A tool gateway can check where an obtained a destination or payment amount before allowing an action. The provenance-gate research note tests this approach by replaying the correct tool calls of tasks, plus an attacker's calls, through a gateway that never reads the injected text. Its rules label each sensitive value as supplied by the user, taken from untrusted tool output, or produced by the model itself, which is treated as suspect.

The reported tradeoff is between blocking harmful actions and interrupting legitimate work for approval. Trusting familiar recipients reduces interruptions, but weakens protection when an attacker contaminates that trusted history. A valid recipient also says nothing about whether the message contains private information. The experiment is a small synthetic replay rather than a live deployment, and it supports a bounded action-control mechanism, with additional protection needed for message contents.

Terms in this piece · Glossary

AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
benchmark — A standard public test set for comparing AI models — the shared scoreboards behind every "model X beats model Y" claim.

Read the source github.com