The README looked harmless. The model saw a hidden instruction.

Description and use

Tamga, a self-hosted proxy, detects hidden instructions in files read by agents and blocks or strips them, preventing indirect prompt injection.

Problem

Agents can be tricked into executing hidden instructions embedded in files they read, enabling indirect prompt injection.

Outcome

Tamga successfully detected and neutralized a hidden instruction in a README file, preventing indirect prompt injection while allowing the agent session to proceed.

Workflow

• 1. Agent calls read_file("README.md") and receives raw content including HTML comment.
• 2. Tamga intercepts the request, parses each message part and its role.
• 3. Tamga scans tool results for hidden text (HTML comments, invisible characters, encoded strings, injection phrases).
• 4. If a violation is found, Tamga either blocks the request (403) or replaces the offending content with a placeholder via the STRIP action.
• 5. The modified request is forwarded to the LLM, which continues the conversation without executing the hidden instruction.

Evidence

The model does. When an agent calls something like read_file("README.md"), the raw text goes back into the conversation as a tool result, comment included.

Source

Tamga reads each part of the request separately and knows which role it came from, so a finding in a tool result is reported as "Found in: Tool result" with its location, e.g. messages[3].content.

Source

With that, the poisoned tool result is replaced by [Content removed by Tamga security policy.] and the request goes on.

Source