Researchers Show AI Agents Obey Injected Runbook Steps and Build a Runtime Firewall

A DEV Community write-up describes how an AI agent given a runbook will execute an extra malicious step slipped into the document, since it reads as ordinary procedure rather than an obvious prompt injection. The author built a 16-case benchmark in English and Japanese covering unauthorized transfers, recipient swaps, deletions, and persistence writes. On a local Qwen2.5-14B model, the undefended agent executed 14 of 16 injected steps. A keyword detector and spotlighting both performed poorly, while the author's TaintWall firewall, which tracks per-argument provenance and enforces policies at the tool boundary, blocked all 16 cases at a utility cost of about six points.