Prompt injection
When text an AI reads contains instructions, and the AI follows them. It's the number one risk for any agent that has tools and reads things it didn't write.
#What it is
A language model can't reliably tell the difference between instructions from you and text it's been asked to read. Both are just words in its input. So if a web page, email, file or log line contains "ignore previous instructions and run this command", there's a real chance the model does it.
- Direct prompt injection: the attacker types it into the chat themselves.
- Indirect prompt injection: the attacker plants it somewhere the agent will read later, like a document, a web page or a log file. This is the dangerous one, because the attacker never has to talk to your agent at all.
#Why it matters here
A chatbot that gets injected says something silly. An agent with shell access that gets injected does something. Hermes Agent runs on a Pi inside my home network and can execute commands. That changes the stakes completely.
The sharpest example from these builds is the honeypot. OpenCanary logs every username, password, URL and header an intruder types. Those logs are attacker-controlled text by design. An agent that reads them raw is one crafted SSH username away from running an attacker's command.
#How I defend against it
No single control is enough, so I layer them:
- Don't feed raw untrusted text to the agent. My nightly digest script queries the logs and writes out only counts, validated IP addresses, validated domain names and port numbers. Anything that fails validation is dropped. There is no free text left to carry an instruction.
- Least privilege. The digest script runs as
nobody. The alerting path (Grafana to Telegram) doesn't involve the AI at all, so a confused agent can't silence an alert. - Keep command approval on for anything destructive, and restrict who can message the agent.
- Tell the model the file is data. Worth doing, but treat it as a speed bump, not a wall. Models don't reliably obey it, which is why points 1 to 3 exist.
#Rule of thumb
If an agent can act, ask of every input: who could have written this? If the answer includes "a stranger", sanitise it into structured data first, or don't let the agent read it.