T01 · Skill Instruction Hijacking
Warning
- Location
anti_loop/core.py:250- Finding
Untrusted Agent Content Is Promoted into Privileged System Messages
- Content
View full analysis
Dict[str, Any]: """Returns a healing directive based on mode.""" self.heal_count += 1 if self.mode == HealingMode.HARD_KILL: return { "action": "abort", "message": f"Loop detected (kill #{self.heal_count}): {last_action[:80]}", "should_continue": False, } if self.mode == HealingMode.PAUSE: return { "action": "pause", "duration_seconds": self.pause_seconds, "message": f"Loop detected, pausing {self.pause_seconds}s", "should_continue": True, } # Default: HEAL import random template = random.choice(self.HEAL_TEMPLATES) # Extract a "topic" from last action topic = last_action[:50] if last_action else "current action" return { "action": "heal", "system_message": template.format( topic=topic, intent=intent or "(no intent recorded)", last_action=last_action[:100], ), "should_continue": True, "heal_count": self.heal_count, } ``` The documented integration explicitly injects this result into the system-message context: ```python if result["directive"]["action"] == "heal": inject_system_message(result["directive"]["syst ...[truncated 2185 chars]- Remediation
View remediation