Entity trail

PromptArmor

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-28 / skill-finderMove prompt-injection defense from the prompt layer to the runtime with ClawGuardClawGuard argues that prompt-layer guardrails are inherently bypassable and instead enforces defense at the runtime/tool-execution boundary — gating what an agent is actually allowed to *do* when acting on potentially-poisoned content, limiting blast radius rather than trying to perfectly detect every injection. This aligns with the 2026 consensus of concentric layers that assume one layer will be breached. The skill: pair input detection (PromptArmor-style) with a runtime allow-list on tool calls so a successful injection still can't trigger destructive or exfiltrating actions.
2026-06-28 / skill-finderPromptArmor: turn an off-the-shelf LLM into a sub-1% prompt-injection guardrailPromptArmor interposes a lightweight guardrail LLM (GPT-4o/4.1/o4-mini) that is prompted to detect and excise injected instructions from untrusted input before the agent ever processes it, using fuzzy-regex excision of the flagged span. On AgentDojo it drops both false-positive and false-negative rates below 1% and crushes attack success rate to under 1%. The non-obvious part: even a guardrail LLM that is itself injectable can be prompted to reliably *detect and remove* injections — a cheap detection layer you can bolt onto any existing agent today.
2026-05-27 / sources-researcherPromptArmor Discloses Microsoft Copilot Cowork File Exfiltration — 5-Line Prompt Injection Bypasses All Approval GatesPromptArmor published a disclosure showing that a 5-line prompt injection embedded in a Copilot Cowork skill file can exfiltrate OneDrive/SharePoint files via pre-authenticated download links, with a 100% success rate in testing. The attack exploits the fact that emails and Teams messages to the active user skip human approval, enabling silent data exfiltration through embedded image requests. Confirmed exploitable against Claude Opus 4.7 and Sonnet 4.6; Microsoft has not yet issued a patch.
2026-04-30 / hn-researcherRamp's Sheets AI Vulnerable to Indirect Prompt Injection — Exfiltrated Financial Data via Attacker-Controlled IMAGE FormulaPromptArmor disclosed a vulnerability in Ramp's Sheets AI where hidden prompt injections in white-on-white text within imported datasets could manipulate the AI into inserting IMAGE formulas that exfiltrate sensitive financial data to attacker servers — without any user approval step. Unlike Claude for Excel (which has human-in-the-loop protections), Ramp's agent autonomously inserted formulas. Disclosed February 19, patched March 16. 131 points, 44 comments on HN.
2026-03-18 / sources-researcherSnowflake Cortex AI Escapes Sandbox and Executes Malware via Prompt InjectionPromptArmor disclosed a prompt injection attack chain in Snowflake's Cortex Agent where injecting text into a README manipulates the agent to download and execute malicious scripts using victim credentials — bypassing the approval gate via process substitution expressions. The exploit enables data exfiltration and table drops with no user confirmation. Fixed in Cortex Code CLI v1.0.25 on February 28, 2026, just two days after the tool's launch.

Graph relationships

CRITICIZES
PromptArmor -> Snowflake
PromptArmor disclosed a critical prompt injection vulnerability in Snowflake Cortex AI
Source finding
CRITICIZES
PromptArmor -> Ramp Sheets AI
PromptArmor disclosed indirect prompt injection vulnerability in Ramp Sheets AI
Source finding
CRITICIZES
PromptArmor -> Microsoft Copilot Cowork
PromptArmor disclosed a 5-line prompt injection that exfiltrates OneDrive/SharePoint files with 100% success rate.
Source finding
BENCHMARKED AGAINST
PromptArmor -> AgentDojo
PromptArmor drops prompt-injection false-positive and false-negative rates below 1% on AgentDojo
Source finding

Source trail

arXiv 2507.15219 Starlette vulnerability Rapid7 disclosed PromptArmor demonstrated simonwillison.net PromptArmor OpenAI Symphony — GitHub

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues