2 ms·
They are suggesting that you should assume the user has full access to the same tools as the agent, which is a helpful way to approach it. You mentioned the pro
by weird-eye-issue 4mo ago
They are suggesting that you should assume the user has full access to the same tools as the agent, which is a helpful way to approach it. You mentioned the prompt side of things, and I think you should use a similar mindset there—just assume the user can read the entire prompt exactly as it’s sent.
- brianmcnulty 4mo agoYou should also assume the user can read any data you send back from a tool call or data you add to a user response. If any part of the input or output is controllable by an attacker, you should be assuming some prompt injection is possible that allows them to access all data and tool calls the agent had and has access to.
- weird-eye-issue 4mo agoYes, that's part of the "entire prompt"