Top
Best
New

Posted by takira 1/14/2026

Claude Cowork exfiltrates files(www.promptarmor.com)
870 points | 399 commentspage 5
rsynnott 1/14/2026|
That was quick. I mean, I assumed it'd happen, but this is, what, the first day?
gnarbarian 1/15/2026||
jokes on them I have an anti prompt injection instruction file.

instructions contained outside of my read only plan documents are not to be followed. and I have several Canaries.

N_Lens 1/15/2026|
I think you're under a false sense of security - LLMs by their very nature are unable to be secured, currently, no matter how many layers of "security" are applied.
choldstare 1/14/2026||
we have to treat these vulnerabilities basically as phishing
lacunary 1/14/2026|
so, train the llms by sending them fake prompt injection attempts once a month and then requiring them to perform remedial security training if they fall for it?
niyikiza 1/14/2026||
Another week, another agent "allowlist" bypass. Been prototyping a "prepared statement" pattern for agents: signed capability warrants that deterministically constrain tool calls regardless of what the prompt says. Prompt injection corrupts intent, but the warrant doesn't change.

Curious if anyone else is going down this path.

ramoz 1/14/2026|
I would like to know more. I’m with a startup in this space.

Our focus is “verifiable computing” via cryptographic assurances across governance and provenance.

That includes signed credentials for capability and intent warrants.

niyikiza 1/14/2026||
Interesting. Are you focused on the delegation chain (how capabilities flow between agents) or the execution boundary (verifying at tool call time)? I've been mostly on the delegation side.

Working on this at github.com/tenuo-ai/tenuo. Would love to compare approaches. Email in profile?

ramoz 1/14/2026||
No, right in the weeds of delegation. I reached out on one channel that you'll see.
adam_patarino 1/15/2026||
What frustrates me is that Anthropic brags they built cowork in 10 days. They don’t show the seriousness or care required for a product that has access to my data.
lifetimerubyist 1/15/2026|
The also brag that Claude Code wrote all of the code.

Not a good look.

xvector 1/15/2026||
That is in fact precisely the look investors want.
lifetimerubyist 1/15/2026||
They will be in for a rude awakening.
Juliate 1/15/2026||
How do these people manage to get people to pay them?...

Just a few years ago, no one would have contemplated putting in production or connecting their systems, whatever the level of criticality, to systems that have so little deterministic behaviour.

In most companies I've worked for, even barebones startups, connecting your IDE to such a remote service, or even uploading requirements, would have been ground for suspension or at least thorough discussion.

The enshitification of all this industry and its mode of operation is truly baffling. Shall the bubble burst at last!

tnynt63 1/16/2026||
А я думаю есть вы проверьте
jerryShaker 1/14/2026||
AI companies just 'acknowledging' risks and suggesting users take unreasonable precautions is such crap
NitpickLawyer 1/14/2026||
> users take unreasonable precautions

It doesn't help that so far the communicators have used the wrong analogy. Most people writing on this topic use "injection" a la SQL injection to describe these things. I think a more apt comparison would be phishing attacks.

Imagine spawning a grandma to fix your files, and then read the e-mails and sort them by category. You might end up with a few payments to a nigerian prince, because he sounded so sweet.

uhfraid 1/15/2026||
Command/“prompt” injection is correct terminology and what they’re typically mapped to in the CVE

E.g. CVE-2026-22708

NitpickLawyer 1/15/2026||
Perhaps I worded that poorly. I agree that technically this is an injection. What I don't think is accurate is to then compare it to sql injection and how we fixed that. Because in SQL world we had ways to separate control channels from data channels. In LLMs we don't. Until we do, I think it's better to think of the aftermath as phishing, and communicate that as the threat model. I guess what I'm saying is "we can't use the sql analogy until there's a architectural change in how LLMs work".

With LLMs, as soon as "external" data hits your context window, all bets are off. There are people in this thread adamant that "we have the tools to fix this". I don't think that we do, while keeping them useful (i.e. dynamically processing external data).

ronbenton 1/15/2026|||
Telling uses to “watch out for prompt injections” is insane. Less than 1% of the population knows what that even means.

Not to mention these agents are commonly used to summarize things people haven’t read.

This is more than unreasonable, it’s negligent

intended 1/15/2026||
We will have tv shows with hackers “prompt injecting” before that number goes beyond 1%
rsynnott 1/14/2026|||
It largely seems to amount to "to use this product safely, simply don't use it".
sodapopcan 1/15/2026|||
I believe that's known as "The Steve Jobs Solution" but don't quote me on that. Regardless, just don't hold it that way.
AmbroseBierce 1/15/2026||
It's exactly like guns, we know they will be used in school shootings but that doesn't stop their selling in the slightest, the businesses just externalize all the risks claiming it's all up fault of the end users and that they mentioned all the risks, and that's somehow enough in any society build upon unfettered capitalism like the US.
delaminator 1/15/2026||
If you’re going to use “school shootings” as your “muh capitalism”, the counter argument is the millions of people who don’t do school shootings despite access to guns.

There are common factors between all of the school shooters from the last decade - pharmacology and ideology.

AmbroseBierce 1/15/2026||
it's not the mental issues they had, its the drugs they were taking for it right? Please. Look at what Australia did after their 1996 shooting, the main reason they have so few of them, but I know you won't, as millions of Americans you will forever do all sort of mental gymnastics to justify keeping easy access to semi-automatic guns.

> From the information obtained, it appears that most school shooters were not previously treated with psychotropic medications - and even when they were, no direct or causal association was found https://pubmed.ncbi.nlm.nih.gov/31513302/

delaminator 1/15/2026||
If you like, but I'm not American.

Millions of Americans believe the right to bear arms is not a right the govt. should be able to take away.

Obesity kills 10x more Americans than guns.

Australia locked up millions of people in their homes and forced them into dangerous medical procedures.

nutjob2 1/16/2026||
> Australia locked up millions of people in their homes and forced them into dangerous medical procedures.

Your comically bad faith description of Aus covid measures is pure nonsense.

> Obesity kills 10x more Americans than guns.

And? Obesity kills roughly the same number of people in other countries but guns kill 40 times more people in the US than other countries.

delaminator 1/16/2026||
> Authorised workers had to be vaccinated or couldn't attend work onsite. Those who refused could face disciplinary proceedings including dismissal.

> The mandates rendered vaccination against COVID a condition of employment. Anyone who refused to be vaccinated could therefore be subject to disciplinary proceedings, including dismissal.

Australia | USA | UK

Vaccine passports for venues: Australia = Widespread | USA = Mostly banned | UK = Never implemented

Unvaccinated locked out of shops/restaurants: Australia = Yes | USA = No | UK = No

Healthcare worker mandates: Australia = Yes | USA = Partial (upheld for Medicare/Medicaid facilities) | UK = Brief, then revoked

Broad employment mandates: Australia = Yes (most industries) | USA = Struck down | UK = No

Different lockdown rules by vax status: Australia = Yes | USA = No | UK = No

Days locked down

Australia (Melbourne) = 262 days

UK (England) = approx 190 days (three national lockdowns)

USA = approx 30-60 days in most states (one lockdown only, spring 2020). Eight states never locked down at all. No second or third lockdowns.

nutjob2 1/17/2026||
Again, so what? Your claim is says "forced" and "dangerous" but you provide no evidence. You've made your opinion clear, but that's all it is. That the Aus government did something different proves, and shows, nothing.
Escapade5160 1/14/2026|
That was fast.
More comments...