Research
Your System Prompt Is Not a Firewall. I Attacked My Own Agent 60 Times to Show It.
First reported · Discovered medium.com
Page published
Earliest dated coverage: 9 Nov 2026 · First observed: 11 Nov 2026 · Latest dated coverage: 9 Nov 2026
Coverage timeline
Single-source research — one report is available.
Why it matters
Monteiro's agent experiment illustrates why authorization for shell execution and persistent-memory changes should be enforced outside the model rather than entrusted to prompt instructions or owner-like account names.
Roan Brasil Monteiro reports running 60 attacks against a Qwen3–1.7B agent built to summarize YouTube comments, including owner impersonation intended to redirect the agent and change its persistent instructions. Across five defenses, the author reports that prompt-based rules failed while code enforcement blocked the attacks despite continued model susceptibility; the supplied excerpt ends before the detailed evaluation.