Controls › C-I1
Retrieved content as data
Text the actor reads is never treated as instruction.
Inputs layerMissing or failed in 5 cases (0 ended in harm)Worked in 0Software agents: 4Software acting on machines: 1
Where it was missing or failed
The third column is what this control would have looked like in that case: the concrete form, not the abstract name.
| Case | World | What it would have looked like here | Status | Outcome |
|---|---|---|---|---|
| GitHub MCP leak 2025 | Software agents | Retrieved issue text treated as instruction | absent | Caught first by researchers |
| EchoLeak 2025 | Software agents | Injection classifier; Treating retrieved content as data rather than instruction (absent) | failed | Caught first by researchers |
| Gemini calendar invite 2025 | Software acting on machines | Input isolation between retrieved content and instructions | failed | Caught first by researchers |
| Claude Code [bot] trust 2026 | Software agents | Issue text resembling an error message treated as instruction | absent | Caught first by researchers |
| Perplexity Comet 2025 | Software agents | Content-instruction separation | failed | Caught first by researchers |
Rules and standards that map to it
Strength says whether the rule's text requires this control, implies it, or only recommends it. Draft mappings are the Register's reading, not yet checked by a person, and none is legal advice.
| Rule | Strength | Where, and why | Jurisdiction |
|---|---|---|---|
| EU Artificial Intelligence Act (Regulation (EU) 2024/1689), high-risk obligations (draft mapping) | Implied | Article 15: resilience against attempts to alter use or performance through manipulated inputs | European Union |
| OWASP Top 10 for Large Language Model Applications (draft mapping) | Recommended | LLM01 prompt injection: treat retrieved and user content as data | Guidance, no jurisdiction |
| NIST AI 600-1: Generative AI Profile of the AI Risk Management Framework (draft mapping) | Recommended | information security risks: direct and indirect prompt injection through content the system reads | United States (voluntary) |
Recent signals touching this control
| Date | Signal | Kind |
|---|---|---|
| 2026-10-30 | CVE-2026-61789: DBHub, a database Model Context Protocol (MCP) server, lets SQL that hides a write behind a double dash pass its read-only check on MySQL and MariaDB The National Vulnerability Database (NVD) record says that before 0.22.6, DBHub's read-only validation can be bypassed on its MySQL and MariaDB connectors, so anyone able to influence the assistant's SQL, including through prompt injection in content the assistant reads, can modify or drop database data, subject to the database account's privileges; fixed in 0.22.6. Source ↗ | vulnerability |
| 2026-10-29 | CVE-2026-119050: Agno PandasTools lets prompt injection make the agent call arbitrary pandas functions, including reading pickle files for code execution The National Vulnerability Database (NVD) record says Agno through 3.1.11 has an unsafe reflection vulnerability in PandasTools that passes model-controlled function names to getattr(), so attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code execution, or call other readers to read local files. Source ↗ | vulnerability |
| 2026-10-21 | CVE-2026-114106: HKUDS Vibe-Trading file-read tools The National Vulnerability Database (NVD) record says HKUDS Vibe-Trading from 0.1.0 before 0.1.7 lets attackers prompt the agent to read server files, including /etc/shadow, API keys in /proc/self/environ and /root credentials, through read_document, which lacks sandbox checks, or tools gated by safe_user_path. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109444: OpenSRE The National Vulnerability Database (NVD) record says instructions injected into alerts or Slack messages triaged by the OpenSRE agent (through 0.1.2026.10.19) can make it run shell commands without confirmation, because the approval check in headless mode always allows execution. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-109440: LangAlpha The National Vulnerability Database (NVD) record says instructions planted in web content retrieved by the LangAlpha agent (through 2026.09.07) can make it run shell commands or Python and exfiltrate vault secrets, because its Bash and ExecuteCode tools lack an allow-list and human approval. Source ↗ | vulnerability |
| 2026-10-20 | CVE-2026-77926: Aix-DB 1.2.4 The National Vulnerability Database (NVD) record says authenticated non-admin users of Aix-DB 1.2.4 can make the ChatBI common agent run operating system commands through its ungated deepagents execute tool, including through malicious text in uploaded documents. Source ↗ | vulnerability |
| 2026-10-19 | CVE-2026-112308: crewai-tools The National Vulnerability Database (NVD) record says crewai-tools through 1.15.28 lets prompt-injected agent tool input direct SeleniumScrapingTool to loopback, private or cloud metadata addresses, disclosing internal data and cloud credentials, because the tool skips its private-address check. Source ↗ | vulnerability |
| 2026-10-13 | CVE-2026-110202 to 110206: Roo Code Five National Vulnerability Database (NVD) records say that in Roo Code through 3.54.0 crafted shell commands delivered by indirect prompt injection can pass the auto-approval command allowlist and run without user approval (one record only on bash 5.3+ or ksh93); no fixed version is named. Source ↗ | vulnerability |
Deploying something? Check a deployment ranks every control against the cases that match your profile. Patterns shows where this control fails across worlds.