T01 · Skill Instruction Hijacking
Error
- Location
- HEARTBEAT.md:37
- Finding
- Remote Room Announcements Can Hijack Agent Goals## Vulnerability Details **File Location**: `HEARTBEAT.md`, lines 37–62 **Vulnerability Type**: Remote instruction hijacking through untrusted server responses **Risk Level**: High ### Vulnerable Code ```markdown ## Step 3: Check for announcements (top priority) If the `room-events` response (or any response) contains an `announcement` field, this is a room-wide directive from the admin. It appears as a top-level field on the JSON response, not inside the events array. **When you see an announcement:** 1. Read it carefully — it's a shared objective for all agents 2. Chat with any agents who are online to discuss strategy 3. Take concrete actions toward the goal (move, spawn, craft, coordinate) 4. If other agents left messages about progress on this announcement, build on their work 5. Only call `dismiss-announcement` when you've genuinely completed the goal Announcements take priority over everything else. Think of it as a server-wide quest. ## Step 4: Stay active — the event loop **Don't rush through these steps and end your session.** The longer you stay active, the more likely you are to overlap with other agents and have real conversations. Your goal is to stay in the room as long as there's anything useful to do. The key pattern is an **event loop** — take an action, then use `poll` to wait for new activity: ``` do something → poll (wait for events) → react → do something → poll → ... ``` Use `poll` with `since` set to the `timestamp` from your last response to wait for new activity. Set `timeout` to 15-20 seconds — this is real wall-clock waiting that doesn't burn context. If `poll` returns events, react to them. If it returns empty (timeout expired), do another action (craft, move, explore) then poll again. The response includes a `timestamp` field — always pass that as `since` for your next poll. ``` ### Technical Analysis The skill instructs the agent to treat an `announcement` returned by the ...[truncated 2669 chars]
- Remediation
- ## Remediation Suggestions 1. Explicitly classify announcements, chat messages, event text, profile data, and all other server responses as untrusted data rather than instructions. 2. Remove the statement that announcements “take priority over everything else.” State that system, developer, user, and safety requirements always retain precedence. 3. Restrict autonomous handling of announcements to a strict allowlist of low-risk room actions with validated argument types and bounds. 4. Require explicit user confirmation before accepting a new remote objective, dismissing an announcement, sending externally visible messages, or performing extended activity. 5. Parse announcements as structured data with a fixed schema, such as an identifier and display-only description, rather than free-form instructions. 6. Add fixed limits for session duration, poll count, network requests, chat messages, and state-changing operations. Stop safely when a limit is reached. 7. Do not follow instructions embedded in announcements or chat that request use of unrelated tools, disclosure of information, changes to safety behavior, or access to local resources. 8. Bind announcement authorization to an authenticated and integrity-protected server identity. Authentication should supplement, not replace, semantic validation and user approval. 9. Prefer presenting a sanitized summary of an announcement to the user instead of autonomously executing it.