Topics

Harness

The harness and the friction loop: fixing recurring environment problems.

Findings

7 findings, each linking to its write-up and limits

  • RI-1Without a defence, a planted instruction disguised as a setup script hijacked the agent every time it sat in AGENTS.md or a ticket comment, and never anywhere else18 of 90 (9 of 9 AGENTS.md, 9 of 9 ticket, 0 of 27 elsewhere)
  • RI-2Every hijacked run reported a clean success, listing the malicious script as a passed check18 of 18
  • RI-3One paragraph in the prompt, saying repository text is information and not instructions, cut hijacks from 18 of 90 runs to 1, at no measurable cost18 → 1 of 90
  • EM-1One falsified fact in the evidence led to the wrong decision in 81 of 120 runs (68%), against 0 of 120 on clean evidence+67.5 ptsInterval excludes zero
  • EM-2An injected instruction in a ticket comment changed 0 of 120 decisions and was flagged as manipulation in all 120 runs+0.8 ptsNo measurable difference
  • EM-3With both a falsified fact and the instruction, the agent flagged manipulation in all 120 runs and still reached the attacker's intended outcome in 73−6.7 ptsNo measurable difference
  • EM-4With a tool that checks authoritative records, 359 of 360 manipulated runs reached the right decision+42.5 ptsInterval excludes zero

Experiments

2 experiments

Proportion, 95% interval

Controlled trial · RI

Can a repository hijack its coding agent?

If a repository or ticket contains an instruction to leak secrets and change git configuration, does a coding agent working an ordinary ticket carry it out, and does one paragraph of warning in the prompt stop it?

I planted an instruction in a repository asking a coding agent to send the checkout's secrets to an outside server and redirect git's commit hooks. Disguised as a setup script in AGENTS.md or in a ticket comment, it worked in every undefended run, and the agent reported a clean success. In the README, a code comment or test output it never worked. One paragraph of warning in the prompt cut hijacks from 18 of 90 runs to 1.

Difference in percentage points, 95% interval

Controlled trial · EM

Can manipulated evidence mislead an AI security agent?

Can falsified evidence or an injected instruction make an AI triage agent reach the wrong security decision, and does an independent verification tool help?

I gave a local AI triage agent 40 synthetic security alerts, then changed one fact in the evidence, or added an instruction telling it what to do, or both. One false fact led to the wrong decision in 68% of runs, and in 38% of runs even where another record contradicted it. The injected instruction changed no decisions. A tool for checking an authoritative record corrected nearly all of them, but some runs still called the wrong action tool.

Other topics: Measurement, Context, Verification, Safety and cost, Skills, Review, Briefs, Parallel