The README looked harmless. The model saw a hidden instruction.

Описание и применение

Tamga, самодостаточный прокси, обнаруживает скрытые инструкции в файлах, которые читают агенты, и блокирует или удаляет их, предотвращая косвенную инъекцию запросов.

Задача

Agents can be tricked into executing hidden instructions embedded in files they read, enabling indirect prompt injection.

Результат

Tamga successfully detected and neutralized a hidden instruction in a README file, preventing indirect prompt injection while allowing the agent session to proceed.

Рабочий процесс

• 1. Agent calls read_file("README.md") and receives raw content including HTML comment.
• 2. Tamga intercepts the request, parses each message part and its role.
• 3. Tamga scans tool results for hidden text (HTML comments, invisible characters, encoded strings, injection phrases).
• 4. If a violation is found, Tamga either blocks the request (403) or replaces the offending content with a placeholder via the STRIP action.
• 5. The modified request is forwarded to the LLM, which continues the conversation without executing the hidden instruction.

Доказательства

The model does. When an agent calls something like read_file("README.md"), the raw text goes back into the conversation as a tool result, comment included.

Источник

Tamga reads each part of the request separately and knows which role it came from, so a finding in a tool result is reported as "Found in: Tool result" with its location, e.g. messages[3].content.

Источник

With that, the poisoned tool result is replaced by [Content removed by Tamga security policy.] and the request goes on.

Источник