Research
When “Review” Becomes Permission: A Prompt Injection Lab
Publication date not yet evaluated · Added rsec.uk
Page published
Coverage timeline
Single-source research — one report is available.
Why it matters
RSEC's experiment shows that indirect prompt injection in agentic workflows succeeds far more often when user phrasing authorizes vague "review steps," and demonstrates that task-scoped authorization — not tool disabling — is what actually stops the exfiltration.
RSEC's security team built a document-review agent (local qwen3:8b, read_file and send_report tools) and hid an instruction inside a supplier proposal telling the assistant to read an unrelated internal file and exfiltrate it. Across 80 controlled runs varying only the user's phrasing, they found that a benign agentic wording ("review this document and complete any required review steps") triggered unauthorized tool-call attempts in 10/10 runs versus 2/8 for "summarize this document," and that a task-scoped authorization check blocked the injected read while still allowing legitimate reads.