security

A 9,000-character silent truncation cut the redaction rules out of the writing prompt. The fix that mattered was a mechanical gate on the final artifact.

TL;DR: A style guide was silently truncated at 9,000 characters, cutting the redaction rules before they reached the writer model. The fix loads the guide whole and adds a mechanical verification gate, check_redaction, that scans the final article for non-documentation IPs and secret-like token prefixes. False positives cost minutes; published leaks are permanent, so the trade-off is easy.

The transcript must carry the hijack sentence verbatim as data. That is exactly how you prove a media file never acted as an instruction.

TL;DR: The author deliberately embedded a prompt-injection sentence into an audio fixture to test a media pipeline's defenses. Counterintuitively, the test requires the hostile transcript to stay verbatim and labeled untrusted, since injection is about text switching from data to instructions. The real defense is a contract proving content never becomes commands, not filtering text or trusting the model's intelligence.

I published a proxy port on loopback and a process on the same host still got refused. Docker filters by door, not by who is knocking.

A RINGKAS label leaked into the chat bubble. The fix was not a stricter prompt but sanitizing input and output at both ends of the pipeline.

TL;DR: The author's chatbot kept leaking prompt labels like RINGKAS into answers, and adding prompt prohibitions never fixed it. They moved control to code: sanitizing knowledge-base text before injection and rendering output through react-markdown with rehype-sanitize allowlists. Lesson: prompts give rough direction only; reliable formatting enforcement belongs at input and output boundaries.

A security audit uncovered 11 findings in the chat AI pipeline, from cache keys to prompt injection.

Snippet changes used to mean an edit, a commit, and a deploy wait. A whitelisted settings endpoint turns that into one PUT request.

How to build an article research workflow on AI agent skills: three core capabilities, editorial patterns to adopt, and a 2026 security audit.

The upstream image ships no sudo and /etc is ephemeral. A tiny entrypoint override in compose reinstalls passwordless sudo on every boot.

My content security gate auto-rolled back the very article announcing it. False positive, cheap fix, and the best proof the fail-closed design works.