Repository navigation
Conversation
![pi-security-bot[bot]](https://avatars.githubusercontent.com/in/1782801?s=60&v=4){kind=small}
There was a problem hiding this comment.
Security Review
No posture context was available; external reachability was inferred from calendar participant-controlled event descriptions. The new agent handoff exposes all meeting databases to indirect prompt injection.
Pi · Helpful? Reply below to let us know! 🦣
| Research every attendee, not just a few: run at least one web search per attendee using their full name plus their company name, for example "Jane Doe Acme LinkedIn". Search result titles and snippets count as evidence even when the page itself (such as a LinkedIn, ZoomInfo, or RocketReach profile) cannot be opened; a snippet like "Jane Doe - Engineering Lead - Acme" is enough for a role. Also search what each company does. | ||
|
|
||
| When an attendee's full name is unknown, their email handle is usually a first name, a first initial and surname, or both. Try these searches in order, stopping once you find them, and run at least two before giving up: the handle as a name plus the company name and "LinkedIn" (for example "Demarcus Mintlify LinkedIn"); the handle plus the company name without "LinkedIn", which also finds ZoomInfo and RocketReach pages; then the full email address in quotes. | ||
| access: [access.edit(people), access.edit(companies), access.edit(meetings)], |
There was a problem hiding this comment.
Medium — Indirect prompt injection gains database-wide access
An external calendar participant can influence the event description, which reaches this web-enabled agent through Agenda and Research context. The prompt instruction to treat content as data is not an enforceable boundary, so malicious calendar or web content could induce reads, writes, or web-based exfiltration involving unrelated rows. This regresses from the deterministic workflow that parsed and validated the agent's JSON. Keep database operations in deterministic code, or enforce row-scoped capabilities and validate every operation outside the model.
Pi · Helpful? Reply below to let us know! 🦣
|
Whoops. |
1 participant
No description provided.