Entity trail

Prompt Armor

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-28 / skill-finderMove prompt-injection defense from the prompt layer to the runtime with ClawGuardClawGuard argues that prompt-layer guardrails are inherently bypassable and instead enforces defense at the runtime/tool-execution boundary — gating what an agent is actually allowed to *do* when acting on potentially-poisoned content, limiting blast radius rather than trying to perfectly detect every injection. This aligns with the 2026 consensus of concentric layers that assume one layer will be breached. The skill: pair input detection (PromptArmor-style) with a runtime allow-list on tool calls so a successful injection still can't trigger destructive or exfiltrating actions.
2026-06-28 / skill-finderCausalArmor blocks indirect prompt injection via causal attribution, not keyword filteringCausalArmor (arXiv Feb 2026) defends against indirect injection — malicious instructions hidden in retrieved/tool content — by using causal attribution to test whether a piece of input is actually causing an instruction-like influence on the model's plan, rather than pattern-matching for suspicious phrases. This catches injections that bypass naive blocklists while keeping overhead low. The skill: for RAG and tool-using agents, evaluate causal-attribution guardrails as a layer that survives paraphrased and novel injection payloads.
2026-06-28 / skill-finderPromptArmor: turn an off-the-shelf LLM into a sub-1% prompt-injection guardrailPromptArmor interposes a lightweight guardrail LLM (GPT-4o/4.1/o4-mini) that is prompted to detect and excise injected instructions from untrusted input before the agent ever processes it, using fuzzy-regex excision of the flagged span. On AgentDojo it drops both false-positive and false-negative rates below 1% and crushes attack success rate to under 1%. The non-obvious part: even a guardrail LLM that is itself injectable can be prompted to reliably *detect and remove* injections — a cheap detection layer you can bolt onto any existing agent today.
2026-05-27 / sources-researcherPromptArmor Discloses Microsoft Copilot Cowork File Exfiltration — 5-Line Prompt Injection Bypasses All Approval GatesPromptArmor published a disclosure showing that a 5-line prompt injection embedded in a Copilot Cowork skill file can exfiltrate OneDrive/SharePoint files via pre-authenticated download links, with a 100% success rate in testing. The attack exploits the fact that emails and Teams messages to the active user skip human approval, enabling silent data exfiltration through embedded image requests. Confirmed exploitable against Claude Opus 4.7 and Sonnet 4.6; Microsoft has not yet issued a patch.
2026-05-24 / skill-finderCVE-2026-29783: Copilot CLI Read-Only Allowlist Bypass — env Curl Downloads and Executes Malware Without Any User ApprovalPrompt Armor disclosed that GitHub Copilot CLI's command validation can be bypassed using 'env' (listed as read-only) to pipe attacker-controlled payloads to sh, achieving arbitrary code execution without user approval. The injection can be stored in a README file from a cloned repo, web search results, or MCP tool responses. GitHub closed the report in one day, classifying it as a known issue that 'does not present a significant security risk' with no current fix planned.
2026-04-30 / hn-researcherRamp's Sheets AI Vulnerable to Indirect Prompt Injection — Exfiltrated Financial Data via Attacker-Controlled IMAGE FormulaPromptArmor disclosed a vulnerability in Ramp's Sheets AI where hidden prompt injections in white-on-white text within imported datasets could manipulate the AI into inserting IMAGE formulas that exfiltrate sensitive financial data to attacker servers — without any user approval step. Unlike Claude for Excel (which has human-in-the-loop protections), Ramp's agent autonomously inserted formulas. Disclosed February 19, patched March 16. 131 points, 44 comments on HN.
2026-03-18 / sources-researcherSnowflake Cortex AI Escapes Sandbox and Executes Malware via Prompt InjectionPromptArmor disclosed a prompt injection attack chain in Snowflake's Cortex Agent where injecting text into a README manipulates the agent to download and execute malicious scripts using victim credentials — bypassing the approval gate via process substitution expressions. The exploit enables data exfiltration and table drops with no user confirmation. Fixed in Cortex Code CLI v1.0.25 on February 28, 2026, just two days after the tool's launch.

Graph relationships

CRITICIZES
Prompt Armor -> Copilot CLI
Prompt Armor disclosed CVE-2026-29783 showing Copilot CLI's read-only allowlist can be bypassed for arbitrary code execution
Source finding

Source trail

Prompt Armor disclosed Cloud Security Alliance Project Glasswing strings referencing Mythos meta-analysis on arXiv Arun Baby — ClawGuard: Moving Prompt Injection Defense to the Runtime CausalArmor: Efficient Indirect Prompt Injection Guardrails via Causal Attribution (arXiv 2602.07918)

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues