The README looked harmless. The model saw a hidden instruction.

说明与用途

Tamga 是一个自托管代理，检测并阻止或删除代理读取文件中的隐藏指令，防止间接提示注入。

问题

Agents can be tricked into executing hidden instructions embedded in files they read, enabling indirect prompt injection.

结果

Tamga successfully detected and neutralized a hidden instruction in a README file, preventing indirect prompt injection while allowing the agent session to proceed.

工作流

• 1. Agent calls read_file("README.md") and receives raw content including HTML comment.
• 2. Tamga intercepts the request, parses each message part and its role.
• 3. Tamga scans tool results for hidden text (HTML comments, invisible characters, encoded strings, injection phrases).
• 4. If a violation is found, Tamga either blocks the request (403) or replaces the offending content with a placeholder via the STRIP action.
• 5. The modified request is forwarded to the LLM, which continues the conversation without executing the hidden instruction.

证据

The model does. When an agent calls something like read_file("README.md"), the raw text goes back into the conversation as a tool result, comment included.

来源

Tamga reads each part of the request separately and knows which role it came from, so a finding in a tool result is reported as "Found in: Tool result" with its location, e.g. messages[3].content.

来源

With that, the poisoned tool result is replaced by [Content removed by Tamga security policy.] and the request goes on.

来源