Should an agent not ask for confirmation, before leaking their patron's contact information to any random third party who asks for it?
If not... That sounds like primetime for prompt injection.
If not... That sounds like primetime for prompt injection.
If I made it send something, I probably made it make a tool call. What other tools can I make it call?
I'm afraid this isn't a shrug - it's a zero-click vulnerability. It might be the start of a chain to RCE. It doesn't have to work every time, either. Just enough of the time.
There are better ways to do this, they just haven’t been built yet.
Eg this may not need actual contact info. Wikipedia just wants a way to ask you to stop. Anthropic could add an opaque agent/session identifier that Wikipedia could flag, and Anthropic just forwards that on to you in the UI.
If you don’t have free text fields it’s usually not super useful for spam. There are ways to get a binary “good/bad” signal back without that though.