Component · spec & evidence

Prompt-Injection Flow-Policy Replay

Replays an agent run to show untrusted text was gated before any sensitive action, leaking no secret.

Contract

Does Replays a recorded sample agent episode (built from synthetic, metadata-only rows) and makes visible whether the instructions the agent treated as trusted were kept separate from untrusted web, tool, or browser text before any sensitive action was taken. Row by row, the record shows where untrusted text flowed, what the policy decided for each flow (allow / warn / block / review) before the action, and that the recorded outcome leaked no secret and disclosed no trusted context. It also bundles deliberately-bad cases it must reject (e.g. untrusted text reaching a sensitive action ungated, or a account secret being exfiltrated).

Scope limit Passing result records only show this projection satisfies the named information-flow contract over synthetic, redacted, metadata-only rows; they do not prove general prompt-injection robustness, benchmark performance, live account/tool/provider safety, hidden-message handling in a real system, source-file changes, or launch-scope decision.

Run

microcosm indirect-prompt-injection-information-flow-policy-replay run-prompt-injection-bundle --input examples/indirect_prompt_injection_information_flow_policy_replay/exported_prompt_injection_flow_bundle --out receipts/runtime_shell/demo_project/organs/indirect_prompt_injection_information_flow_policy_replay

Evidence

ClassComputed projectionevidence 3/5Source-faithful refactor

ai-safetyagent-evaluationred-teaming

Source

Source Design note · Source

Map Show on the map

Index Open compact index card

Paper module