“#6 𝕏 claire vo 🖤 questioned whether agents can work without indexing source data, how ephemeral connectors and stored data should be presented to users, and how to prevent prompt injection.”

#6 𝕏 claire vo 🖤 questioned whether agents can work without indexing source data, how ephemeral connectors and stored data should be presented to users, and how to prevent prompt injection. She characterized an unnamed harness as immature and lacking user-empathetic evaluation, while noting that self-serve data deletion shipped but promised email follow-up did not occur.

“He described prompt injection as the most common way scammers attack people and agents, including by using malicious website text to trick agents into disclosing credentials.”

𝕏 Boris Cherny shared a prompt-injection benchmark created by an unnamed independent researcher and said Anthropic has largely solved the threat in practice for Claude models, with red-team testing producing similar results. He described prompt injection as the most common way scammers attack people and agents, including by using malicious website text to trick agents into disclosing credentials.

“Boris Cherny said stacking model training, input probes, and an intent-checking classifier can bring indirect prompt injection to ~0 on unseen attacks—a result he did not expect a year ago.”

#6 𝕏 Boris Cherny said stacking model training, input probes, and an intent-checking classifier can bring indirect prompt injection to ~0 on unseen attacks—a result he did not expect a year ago. He also announced that auto mode would become the default in Claude Code the following week.

“Simon Willison Prompt Injection as Role Confusion - Discussion of a paper showing models confuse privileged role-tagged text with user text based on style, enabling serious jailbreaks; the authors demonstrate that 'destyling' text can dramatically reduce attack success.”

This item discusses prompt injection defenses and a specific failure mode called role confusion.

“Telemetry showed users approved ~93% of permission prompts, Claude Code auto mode blocks roughly 83% of overeager behaviors before execution, and Claude Opus 4.7 resists prompt-injection with about 0.1% success on single attempts and ~5–6% after 100 adaptive attempts.”

📝 Anthropic Engineering How we contain Claude across products - Anthropic has deployed Claude across claude.ai, Claude Code, and Claude Cowork while containing blast radius via environment controls (sandboxes, VMs, filesystem/egress limits), model-layer controls (system prompts, classifiers, probes, training), and restricting external-content/tool access, noting Claude Mythos Preview was judged too risky to ship in April 2026. Telemetry showed users approved ~93% of permission prompts, Claude Code auto mode blocks roughly 83% of overeager behaviors before execution, and Claude Opus 4.7 resists prompt-injection with about 0.1% success on single attempts and ~5–6% after 100 adaptive attempts.

“They acknowledge model defenses aren’t perfect—Claude Opus 4.7 shows ≈0.1% attack success on single prompt-injection attempts and ≈5–6% after 100 adaptive attempts—cited Mythos Preview as too high a blast radius to ship in April 2026, and argue combined environment, model, and external-content controls are necessary to cap agents’ blast radius.”

Anthropic ships Claude Code auto mode #1 📝 Anthropic Engineering How we contain Claude across products - Anthropic says it has shipped claude.ai, Claude Code, and Claude Cowork and moved from human-in-the-loop approvals—which users accepted about 93% of the time, producing approval fatigue—toward containment (sandboxes, VMs, egress controls) and automated defenses like Claude Code auto mode, which catches roughly 83% of overeager behaviors. They acknowledge model defenses aren’t perfect—Claude Opus 4.7 shows ≈0.1% attack success on single prompt-injection attempts and ≈5–6% after 100 adaptive attempts—cited Mythos Preview as too high a blast radius to ship in April 2026, and argue combined environment, model, and external-content controls are necessary to cap agents’ blast radius.

“#8 📝 Simon Willison Microsoft Copilot Cowork Exfiltrates Files - A report describes how Microsoft Copilot Cowork allowed agent-sent emails to leak data via externally rendered images and pre-authenticated OneDrive links, creating a path for prompt-injection exfiltration.”

#8 📝 Simon Willison Microsoft Copilot Cowork Exfiltrates Files - A report describes how Microsoft Copilot Cowork allowed agent-sent emails to leak data via externally rendered images and pre-authenticated OneDrive links, creating a path for prompt-injection exfiltration. The post highlights the continued challenge of designing agentic systems that don't enable attackers to extract sensitive data.

“Designing AI agents to resist prompt injection - This post describes techniques for designing AI agents that are robust against prompt injection attacks, outlining security practices and mitigations.”

Today's top 25 insights for PM Builders, ranked by relevance from Blogs, X, LinkedIn, and YouTube. #10 𝕏 Google Research partnered with @BIDMC_Medicine to pilot AMIE, a conversational AI for clinical reasoning, and in a real-world study found it to be safe, feasible, and well-received by patients. #11 📝 OpenAI News Designing AI agents to resist prompt injection - This post describes techniques for designing AI agents that are robust against prompt injection attacks, outlining security practices and mitigations. It focuses on architecture and behavioral approaches to reduce the risk of maliciously crafted inputs influencing agent behavior.

“#19 📝 Simon Willison Clinejection — Compromising Cline’s Production Releases just by Prompting an Issue Triager - Adnan Khan details an attack chain where a prompt injection in a GitHub issue title against an AI-powered triage workflow led to a cache poisoning attack that allowed publishing malicious NPM releases.”

GenAI PM Daily March 07, 2026 GenAI PM Daily 🎧 Listen to this brief 3 min listen Today's top 25 insights for PM Builders, ranked by relevance from LinkedIn, YouTube, X, and Blogs. #18 📝 Simon Willison Agentic manual testing - A guide explaining that coding agents' defining capability is executing the code they write, and emphasizing the necessity of running generated code to verify correctness. The post argues that agents can iterate until code works, but humans should not assume generated code functions without execution. #19 📝 Simon Willison Clinejection — Compromising Cline’s Production Releases just by Prompting an Issue Triager - Adnan Khan details an attack chain where a prompt injection in a GitHub issue title against an AI-powered triage workflow led to a cache poisoning attack that allowed publishing malicious NPM releases.