Unverified50% confidenceCautionExact time
The tool names, descriptions, input schemas and annotations provided by a page should all be treated as untrusted input, and a "read-only" annotation cannot prove that the operation will not modify data.
1
Sources
50%
Confidence
Long-term
Relevance
10/17/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe rule the author set for the browser agent is that it may copy and paste, but may not read, recite, narrate, or transcribe the key.71% similarUnverifiedAt the tool definition layer, a strict boolean flag requires_human_approval is added to each operation, set to false for read operations and true for table-deletion operations, and the language model does not know this flag exists.70% similarUnverifiedThe open-source claude-code-security-review action explicitly states in its README that it has not been hardened against prompt injection.70% similarUnverifiedRead tools and write tools should be separated, and critical values should be re-read before submission to avoid approving an already-modified invoice with stale recommendations.69% similarUnverifiedThe list of allowed tools and the stop-loss words should exist in code rather than in prompts, because prompts can be talked around while checks in code cannot.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1053902API
curl https://kongchang.com/api/v1/knowledge/claims/1053902MCP
get_claim(id=1053902)