The Confused Deputy

Direct prompt injection is the older, more visible half of the map. Someone using your chatbot, copilot, or agent types (or pastes) text intended to change the product’s job. Jailbreaking is the policy-bypass form of that attack. OWASP treats jailbreaking as a form of prompt injection, not as a separate magical category.

The defensive mistake is to spend the entire budget on witty system-prompt language. Anthropic’s published DPI controls are operational: a harmlessness screen, input validation against known injection patterns, an ethical system prompt as documentation of policy, and consequences for repeat offenders. None of those is a cryptographic boundary. They reduce casual abuse. They do not replace authorization.

Rogue Prompt will not publish working bypass strings, even as “examples.” The useful artifact is the threat model: if the user can make the model call a tool, the user channel is an untrusted input to a privileged deputy. Design the product as if some users will try.

Simon Willison’s 2023 framing still holds: this is an attack against applications built on top of models. The application mixed a trusted instruction, untrusted text, and a privileged action in one context window. The model cannot reliably tell which tokens are the job and which tokens are scenery.

OWASP LLM01:2025 says the same in standard language: indirect injections occur when an LLM accepts input from external sources such as websites or files, and that content alters behavior. Severity follows agency. A summarizing chatbot fails small. An email agent with send privileges fails large.

The concealment requirement is what turns IPI into an operations problem rather than a demo. If the user-facing reply looks ordinary while a tool call has already done harm, the victim has no signal to stop. That is why this building exists: to walk the trust boundary, not to collect funny stickers. Funny specimens of the same idea live on Claude Gone Wild’s prompt-injection desk.

Most teams still draw the map as DPI versus IPI and stop. That was accurate for 2023 chatbots. It is incomplete for 2026 agents with memory, retrieval, and fine-tunes. The SoK’s third vector exists because a payload can be waiting in the store before the user ever types.

The practical control is boring on purpose. Retrieval is a data-access problem: who can write, who can read, what is re-scanned, what is cited back to the user as a source rather than obeyed as a command. Fine-tuning is a change-management problem. Neither is solved by wrapping the chunk in XML tags.

If your threat model still says “the only untrusted input is the chat box,” this room is the reason to redraw it before you grant the deputy a tool.

A confused deputy is dangerous in proportion to what it can see and what it can do. The see-list for 2026 agents is no longer “the chat box.” It is every byte the runtime fetches: HTML, PDF text, OCR, issue threads, package READMEs, calendar invites, and the JSON a tool just returned.

Anthropic’s computer-use precautions are the right shape even if you never call that tool: a dedicated VM or container, no unnecessary secrets, an allow-list for the network, and a human on actions that spend money or grant consent. Those are ordinary software controls. They still work when the model is confused.

Capability raises the stakes without automatically raising robustness. Simon Willison watched Claude Fable 5 invent window capture, template hacks, and a CORS sidecar to debug a two-line CSS bug, then warned that the same proactivity is terrifying under hidden instructions. Gray Swan found capability and robustness only weakly correlated. Smarter is not the same as fenced.

Name the five categories. Do not ask this page for a payload that exercises them.

Action switching hijacks control flow: the user asked for one tool, the observation pushes another. Parameter manipulation hijacks data flow: the tool is right, the account number or filename is not. Branch divergence fabricates a fact that sends the agent down the wrong conditional. Reasoning corruption interferes with aggregation, sorting, or comparison so the decision is internally consistent and externally wrong. Delegation exploitation is the trust-chain case: the user said to follow an external file, and the file exceeds the implicit safety boundary of that request.

This is why “just ignore untrusted context” is not a product strategy. The product’s job is to look. A defense that wins a static benchmark by refusing to look will fail the day you hire the model as an agent. The SoK’s headline evaluation result is the one to take into design review: no tested approach was at once trustworthy, useful, and cheap.

The dual objective is the part most vendor dashboards still skip. Measuring whether the model said “no” is not the same as measuring whether a tool ran and the user was told a quiet story. Users cannot protect themselves from an attack they cannot see. That sentence is Gray Swan’s, and it is the design constraint.

We will not describe the “universal attack” template in copy-paste form. The published category is environment-framing: injected text treated as if it were a system-level command. That is a structural weakness in instruction-following, not a bug in one model family. Naming the category is enough for a defender to hunt it in logs. Publishing the template would be a different site.

Transfer is the operational punchline. Attacks that originally broke Claude Opus 4.5 transferred to every other tested model at 44–81%. If an attacker cracks the most robust model, they likely crack the rest. That is why “we use the strong one” is not a complete answer, and why dated vintage matters when someone pastes these numbers onto a later model.

Browser use concentrates both halves of the confused-deputy problem: a vast untrusted surface and a large action set. Anthropic’s published category on that page is hidden instructions in content the agent processes for a user — they illustrate it with inbound email. We will not reproduce that illustration as a recipe. The category is enough: if the agent can read a message and also send one, the read is a control plane.

The defenses they describe are the right shape for any browser agent, not only Claude for Chrome: train the model to refuse injected instructions in simulated web content, classify untrusted context before it becomes a goal, and keep humans in the loop for high-value tasks. Scaled expert red teaming is listed as a third leg. None of the three is claimed as a seal.

Date the number. November 2025, Opus 4.5, internal attacker. If you are choosing a 2026 model, this is historical evidence of residual risk, not a scoreboard row for Fable 5.1.

How do you prevent prompt injection? You do not, completely. OWASP is blunt: given how generative models work, it is unclear there are fool-proof methods. The list they publish is impact reduction: constrain behavior, validate output, filter, enforce least privilege, require human approval for high-risk actions, segregate external content, and attack your own trust boundaries.

Anthropic’s current hardening notes are the most concrete packaging of that list for a tool-using model. Untrusted content lives in tool_result. The tool description says what the bytes are and where they came from. The system prompt says those bytes must not override the user. JSON encoding makes it harder to break out of a data context. A small model may screen the result before the main model sees it. The application, not the model, decides whether a tool call is allowed.

Two adjacent failure modes belong on the same wall. First, capability without a fence: Willison’s Fable 5 session is the reminder that a model which will invent a CORS sidecar to fix CSS will invent something worse under a hidden instruction. Second, a confused environment: Willison’s 27 August 2026 note on Claude Code Auto Mode, covering Johann Rehberger, is filed as environment interaction rather than classic prompt injection. In some runs a classifier allowed a start and blocked cleanup. We credit those write-ups. We do not reproduce the method. Sandbox, restrict egress, keep secrets off the runtime — that is the published conclusion, and it is enough.

Pliny the Prompter (elder-plinius/L1B3RT4S) maintains a large public corpus of jailbreak and prompt-injection templates aimed at flagship models. The existence of that corpus is part of the threat landscape. Reproducing it here would make Rogue Prompt an attack cookbook, which the concept for this site forbids.

The legitimate defensive use is documented by Promptfoo: include a pliny plugin in an authorized red-team config, fetch prompts, and check that your system refuses rather than complies or parroting. Docs were updated 20 September 2026. License remains AGPL-3.0. If you need a refusal test, use the plugin against your own system.

If you came for the cartoon version of a cafe-sign injection, that is a different building: claudegonewild.com/prompt-injection/. This one stays with OWASP language, dated numbers, and controls you can take into a design review.