Ideas · Builder Notes
Taint, two lanes and instruction authenticity against prompt injection
Kognita alpha 0.5 labels runs that touch external content or client data, and stops tainted runs from writing or reaching public lanes.
Prompt injection is a data-flow problem. Once a run reads untrusted content, its later actions cannot be trusted the same way.
Runs carry sticky taint labels for external content and client data. Tainted runs cannot call write or high-autonomy tools. The public-content lane is unreachable after client data. Envelopes carry an assurance level; channel messages alone are denied, and relays cannot raise assurance.
Taint is sticky. It never washes off within a run.
Injection attempts are evidenced and alerted. Several ways to launder taint through runless calls were found and closed later.
What I'd do differently
I'd hunt for laundering routes in the same release. Runless calls and nested arguments turned out to drop taint, and those were only found in review.
Take this with you
Do not try to detect every injection. Limit what a tainted run is allowed to do.
Sources
Kognita is an open-source alpha. This note comes from Kognita PR #58 in the Kognita repository.