Prompt injection flaw lets rogue text hijack AI agents; developer builds fix

AI agents that read files, emails, or web pages are vulnerable to prompt injection, where malicious instructions hidden in documents can trick the agent into performing unauthorized actions. A developer tested 10 open-source detectors against 629 realistic attacks from ETH Zurich's AgentDojo benchmark and found none performed reliably — the best caught only about half, while others blocked nearly all safe content. The core problem identified is that modern attacks use ordinary-sounding sentences indistinguishable from legitimate user commands, making word-based detection largely ineffective. In response, the developer built a small tool called taintgate, which sits between an AI agent and its tools and tracks the origin of each instruction — distinguishing user input from external content. Rather than analyzing words alone, taintgate applies user-defined rules to allow, block, or escalate actions for human review based on where the triggering text actually came from.