Threadreaderapp authors publish 20 prompt injection test cases

The author argues that prompt injection tests often grade the wrong output by reading an agent's polite reply instead of checking whether restricted tools were called. To address this, they present twenty test cases designed to grade agent actions across direct, indirect, and overlooked attack vectors. The practical takeaway is that adding a human confirmation step before money moves or data leaves remains the cheapest security fix. Open article →