SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Batching AI agent card fields let a prompt-injection slip past a content guardrail

0
·1 views

A developer building an AI access-certification tool called Muster discovered a critical flaw in how prompt-injection guardrails were applied to agent cards — self-descriptions served by AI services on Google Cloud. To reduce API calls, the tool concatenated all fields of each card into a single string before sending it to Google Cloud Model Armor for screening. Testing on 23 August 2026 showed that while the injected description alone was correctly flagged as a threat, the combined string of all card fields returned a clean result — despite the hostile text remaining byte-identical. The classifier scored the entire blob rather than evaluating individual sentences, allowing benign surrounding text to dilute the malicious signal. The developer recommends screening each field separately and also as a combined string, blocking a card only when every individual pass returns clean.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

CTF Challenge Shows How HTTP Request Smuggling Bypasses Path-Based Access Controls

A web challenge from BrunnerCTF 2026 demonstrated a classic CL.TE HTTP request smuggling vulnerability in a simulated internal wiki application. The target page, /wiki/internal/flag, was hinted at via robots.txt but returned a 403 Forbidden response to direct access. The exploit worked because the front-end proxy honored the Content-Length header while the backend Kestrel server prioritized Transfer-Encoding: chunked, causing the two layers to disagree on where one request ended and another began. By crafting a single POST request containing a smuggled GET for the restricted path, the attacker bypassed path-based authorization middleware that only applied to externally routed requests. The smuggled request reached Kestrel directly on the same keep-alive connection, returning the internal article and the hidden flag.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Dev Builds CUBELANDS, a Procedural Open-World Action-Adventure Headed to Steam

An independent developer is building CUBELANDS, an early-alpha third-person open-world action-adventure game planned for release on Steam. The game's core design principle is full procedural generation, where a single seed determines terrain, settlements, cultures, characters, equipment, and even boss designs. Gameplay combines exploration, combo-based combat, and traversal mechanics such as gliding, grappling, swimming, and slope-surfing. Combat features charged and aerial attacks, parries, perfect-dodge counters, and multi-phase procedural bosses. No release date has been announced, with the developer focused on refining the world, combat, and presentation before sharing further progress updates.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

How 22 passing tests missed a minesweeper solver bug that inverted life-or-death guesses

A developer built a minesweeper probability solver, validated it with 22 unit tests and cross-checked it against a brute-force implementation across 8,000 random boards, finding only floating-point-level differences. After integrating the solver into a playable website, roughly 300 games in, the solver flagged six squares as certain mines when only two actually were. The flaw was exposed by a telling anomaly: the per-cell mine probabilities summed to 13.96 on a board that had only 10 mines remaining, violating the mathematical requirement that those probabilities sum exactly to the mine count. The root cause was a mean-field approximation fallback used when a board component grew too large for exhaustive enumeration, producing estimates that were not true probabilities but were still being treated as certain by the finalize function. The case illustrates how a thorough test suite can miss critical bugs if the specific edge-case inputs that trigger a flawed code path are never exercised.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Open-Source CLI Tool Lets AI Agents Access Slack Without Building a Slack App

A developer has released SlackCLI, an open-source command-line binary that allows AI agents to interact with Slack workspaces without requiring a dedicated Slack app or OAuth approval process. The tool enables agents to read messages, search channels, reply to threads, and access Canvas documents by running simple shell commands with structured JSON output. Authentication is handled via a browser-based login that stores session tokens locally on the user's machine, with no data sent externally. SlackCLI is designed to integrate easily with most AI agent frameworks, which typically work best with plain commands and clean, parseable output. The project is unofficial and has no affiliation with Slack Technologies.

0 comments Read more at DEV Community
Batching AI agent card fields let a prompt-injection slip past a content guardrail · ShortSingh