The Database Note That Copilot Read
SQL Copilot's instruction metadata got me thinking about who can leave notes for an agent, and whose permissions it has when it acts on them.
notebook / tag
#prompt-injection
6 entries with this tag.
What Did the Agent Actually Read?
Use CyberChef to inspect an encoded instruction in a tool response, then separate an agent's proposed action from what actually happened.
Prompt-Injection Testing Belongs in CI
ToolHazard turns indirect prompt-injection testing into executable, stateful evaluation. The useful lesson is not its leaderboard. It is how to make agent security a repeatable release gate.
Disabled Is Not Removed
Two Rovo disclosures show why agent governance cannot stop at an admin-console toggle. Security teams need to verify runtime capabilities, data reach, and egress independently.
Telemetry Is an Instruction Channel
GhostJacking shows how attacker-controlled text can cross from WAF events, logs, and error reports into privileged agent actions. The missing control is provenance from evidence to side effect.
Detecting the Confused Deputy in Azure DevOps MCP
A hidden pull-request comment turned legitimate MCP calls into a cross-project data path. Detecting it requires source, identity, scope, sequence, and sink.