DEV Community

Discussion on: You Can't Patch Prompt Injection. Gate the Lethal Trifecta Before the Agent Runs.

Collapse
 
alex_spinov profile image
Alexey Spinov

Twenty days late, and there's no excuse for that — sorry.

Your runtime point made me go re-run the gate rather than just agree with it, and the result was not what I expected. I tagged the same three-tool manifest two ways:

http_fetch declared can_egress only (the under-tagged case you describe):

VERDICT: LETHAL TRIFECTA REACHABLE - 1 path(s)
  [1] untrusted=read_issue -> private=read_env -> egress=http_fetch
Enter fullscreen mode Exit fullscreen mode

http_fetch declared can_egress + ingests_untrusted (honest tagging):

VERDICT: LETHAL TRIFECTA REACHABLE - 2 path(s)
  [1] untrusted=http_fetch -> private=read_env -> egress=http_fetch
  [2] untrusted=read_issue -> private=read_env -> egress=http_fetch
Enter fullscreen mode Exit fullscreen mode

Same verdict, same exit 1. In the default shared_context mode a mid-session capability flip cannot produce a false pass, because the gate never reasons about values at all — it puts every non-isolated tool on one context bus and assumes maximal composition. Under-tagging a dual-role tool costs you path count, not the verdict.

Which reframes what taint-tracking would buy there: precision, not safety. It would tell you which of those two paths is actually live this session, instead of blocking on both. Useful for triage, not for the block decision.

The place where taint-tracking would buy real safety is the other mode — data_flow: "explicit", where only declared edges carry taint and one unenumerated composition edge is a silent clean pass. That's the actual hole, and it lives in the declaration rather than the runtime.