Unverified50% confidenceFactExact time
ReskPoints only records actions but does not block them; policy enforcement must be done in the Agent code (such as an email domain allowlist); masking relies on field names and regex, and may fail for PII in free text; sampling may miss low-frequency attacks, and sensitive actions should remain fully sampled.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/15/2026
First Seen
Valid until: 1/13/2027
Sources
Related Entities
Related Claims
UnverifiedCustomer messages should be treated as task data rather than as authorization to modify workflows; this is a direct defense against prompt injection attacks.67% similarUnverifiedIn Agent scenarios, unnecessary output should be limited, and input prefixes should be reused as much as possible (such as using prompt caching) to reduce the cost of repeatedly inputting long contexts.67% similarUnverifiedFeasible approaches to implementing human-in-the-loop on Agents include tiering by operation type (reads and writes can be fully automated, while deletion, overwriting, and batch moves force a pause and request confirmation) and introducing a dry-run mode that first outputs a list of files to be deleted for the user to check.66% similarUnverifiedHeap Code的Agent Mode中每一个非只读操作都会触发权限确认提示，并支持一键回滚64% similarUnverifiedReskPoints provides the @log_action decorator, which can automatically record parameters and results for high-risk functions (such as send_email).64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1033972API
curl https://kongchang.com/api/v1/knowledge/claims/1033972MCP
get_claim(id=1033972)