Instruction boundaries in retrieved content
We test whether directives embedded in retrieved pages, documents, or tool responses can alter the user's task, shape subsequent responses, or trigger an unintended tool call.
AI SECURITY RESEARCH
Security research, from prompts to model files.
A retrieved page can redirect an agent. A tool can act on model output. A downloaded model file can contain unsafe behavior. We investigate these paths with targeted tests and document what we observe.
RESEARCH SCOPE
Where we examine trust boundaries
01Prompt injection
Retrieved contentAgent instructions
Whether source material changes the authorized task.
02Agent permissions
Model outputPrivileged tool call
Where authorization and approval checks apply.
03Data exposure
Sensitive contextOutbound channel
Where information can leave the workflow.
04Model files
Model artifactLoading process
Whether loading introduces executable behavior.
RESEARCH QUESTIONS
What we examine
Our work focuses on the boundaries between untrusted inputs, system permissions, and sensitive data.
From untrusted input to privileged action
We trace how an external instruction reaches a tool, then examine the permissions, approval steps, and user intent checks along that path.
Data movement across agent workflows
We follow sensitive context through retrieval, prompts, tool arguments, external requests, and logs to identify where it could be disclosed.
Trust before a model is loaded
For teams running downloaded models, we examine file formats and loading paths for code a file would run and for behavior that starts before the model answers its first request.
METHOD
What a finding records
A finding should show its setup, input, observable effects, and limits.
Test configuration
The authorized task, model, tools, permissions, and relevant system settings.
Input and entry point
The payload, its source, and the point where it crossed into the workflow.
Observable result
The response, tool activity, and any data movement visible during the test.
Scope of the finding
The conditions under which the behavior appeared and the limits of what was observed.
A result applies to the configuration tested. Changes to the model, tools, or permissions can change the outcome.