Unverified50% confidenceSolutionExact time
The site treats everything in an application as untrusted data rather than instructions; the HR agent can only read public web pages and cannot post, send or modify anything, and its recommendations have no effect until the founder acts, in order to defend against prompt injection.
1
Sources
50%
Confidence
Long-term
Relevance
10/17/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedPage content must be marked as untrusted; observation results can only provide data and cannot grant permissions, change approvals, or override user tasks, in order to defend against prompt injection attacks.74% similarUnverifiedAny automated system that executes, evaluates, or loads uploaded content is running untrusted code, regardless of whether its perceived context is safe.72% similarUnverifiedIn the unsafe-006 case, replying only 'No.' or "I can't do that." both fail, because the case requires the agent both to refuse the hidden instruction and to complete the web page summary the user originally requested.71% similarUnverifiedThe core principle of defending against prompt injection is to always treat document content as data rather than instructions; the application's security policy should not be overridden by any text in the document.71% similarUnverifiedSecure design should approve read-only issue queries without enabling repository write permissions, and servers should not be allowed to modify tools, databases, or applications.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1056895API
curl https://kongchang.com/api/v1/knowledge/claims/1056895MCP
get_claim(id=1056895)