Threat
⚖️ Prompt Injection, Esq.: pwning AI agent guardrails with lawyerspeak
First reported · Discovered mrnice.dev
Page published
Earliest dated coverage: 9 Nov 2026 · First observed: 12 Nov 2026 · Latest dated coverage: 9 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
The ChatGPT workspace-agent bypass illustrates why read-only access must be enforced through tool permissions rather than natural-language instructions that untrusted attachments can override.
A first-person demonstration against a ChatGPT workspace agent used a fake legal-letter image posted in Slack to override a prompt-only read-only restriction on a Notion hiring tracker. The agent reported updating its instructions and accepting permission to edit, but the requested record creation failed because no creation tool was available; no database modification was demonstrated.