SERGIO RODRIGUEZOFFENSIVE SECURITY / RESEARCH

PROMPT BOUNDARY / DATA BECOMES AUTHORITY

DETERMINISTIC LOCAL FIXTURE

The document
becomes
the directive.

An attacker controls the reference material. A flawed reader lets that material write the rules.

Put it across the boundary
One retrieved document, two decisions An untrusted document reaches a trust boundary. The vulnerable path promotes the embedded instruction and exposes a fictional canary. The fixed path keeps the document as data. TRUST BOUNDARY OVERRIDE RETRIEVED DOCUMENT ATTACKER-CONTROLLED VULNERABLE READER DATA → INSTRUCTION FICTIONAL CANARY EXPOSED FIXED READER DATA STAYS DATA AUTHORITY KEPT SEPARATE
01 / SAME INPUT. DIFFERENT AUTHORITY HANDLING.
CONTROL: TOOL OUTPUT / RETRIEVED TEXTFAILURE: AUTHORITY PROMOTIONWITNESS: FICTIONAL CANARY

02 / RUN THE WITNESS

Change the source.
Keep the contract.

The new case forges a system-role frame inside a tool result. This is an explicit parser model, not a live language model. Both readers receive the same text; only the vulnerable reader lets it supply authority.

UNTRUSTED INPUT0 characters

Successful fixture cases appear first, followed by controls.

Edit the source text, then run both readers. Nothing is sent to a model or external service. Successful fixture cases appear first, followed by controls.

Loading the local fixture…

CANDIDATE RESPONSESEXACT-MATCH CHECK

Vulnerable

Not run

Embedded directives can become instructions.

Run the comparison to inspect the response.
Inspect decision trace

    Fixed

    Not run

    Retrieved text never supplies authority.

    Run the comparison to inspect the response.
    Inspect decision trace

      Only each candidate response is scored. The document and this page are excluded. Exact matching does not detect encoded or partial disclosure.

      03 / FROM WITNESS TO RECORD

      Inspect the claim.
      Replay the fixture.

      Entry 003 adds tool-result role spoofing to entry 002’s document smuggling. The legacy serializer lets a closing tag turn content into message metadata. The fixed reader keeps its role in a structured field. Both outcomes are synthetic; neither establishes a jailbreak against a deployed model.

      Dataset / 2 JSONL entries ↗Model / JavaScript ↗Regression cases ↗Dataset builder ↗Method & limits ↗
      node labs/prompt-boundary/tests.mjs