Repository navigation
feat(audit): log what Lens caught of prompt injection - #344
Merged
Merged
Conversation
Tool results the assistant or the MCP server flagged as reading like instructions to an AI (assistant.injection_flagged, mcp.injection_flagged) and chat-room answers that had links broken up (bridge.links_broken) go into the audit log, with the reasons and counts, never the text. docs/assistant.md says how the injection layers stand on their own. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BVez82cREgCJtFk6yHReed
This was referenced Oct 10, 2026
adeelahmad
added a commit
that referenced
this pull request
Oct 11, 2026
…349) "Stay private and safe" now covers flagging instruction-like text (patterns or the optional local classifier, #329, #347), asking before the browser acts on what the assistant wrote (#333), breaking up links in chat-room answers (#338), the archive as data over MCP (#343) and the audit log of what was caught (#344). "See what it costs" adds the overall budget asked for in setup (#281). "In progress" drops what merged and adds #337, #341 and #346. Claude-Session: https://claude.ai/code/session_01HDx7PPUauyjMn1LZs8JAsS Co-authored-by: Adeel Ahmad <noreply@anthropic.com>
adeelahmad
pushed a commit
that referenced
this pull request
Oct 14, 2026
P-INJECTION-EGRESS: once an answer has read text from outside Lens, outbound tools and setup changes ask first, and chat-room answers keep only the links people, the archive, tools or Lens wrote. Correctness-only, a bypass is VALID-HARDENING (Q26). The Assistant x-prompt-injection row is now claimed; N-PROMPT says marking and flagging make injection less likely and are not claimed; MCP results and the optional classifier are described; Q26 lists #302, #309, #329, #338, #343, #344 and #347. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BVez82cREgCJtFk6yHReed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by Adeel · project thread
Description
Before: when the assistant flagged a tool result as reading like instructions to an AI (#329), the MCP server added its note (#343), or a chat-room answer had links broken up (#338), only that one answer showed it. An admin had no way to see that someone was trying to steer Lens through the archive.
After: each of these goes into the audit log (
GET /api/v1/audit, Settings → Audit for admins):assistant.injection_flaggedonchat:<id>, with the tool and the reasons;mcp.injection_flagged, with the reasons;bridge.links_brokenonchat:<id>, with how many links.The audit row holds the reasons and counts, never the text itself.
docs/assistant.mdnow also says how the layers stand on their own, so one failing doesn't open the path.Sixth of the prompt-injection series (#302 marking, #309 asks first, #329 flags, #338 room links, #343 MCP). Next: an optional local classifier, and the threat-model update.
Motivation and Context
Adeel asked for multi-layered security; the coordinator's brief named audit logging as one of the layers. An attempt that every other layer stopped still says someone planted text in a document or a room, which an admin wants to know.
How:
auth.audit(...)calls inToolbox.call(whenuntrusted.flagsmatched), inmcp_tools.calland inbridge.answer(whensafe_linkschanged the text).Types of changes
!in the title)Checklist:
make hookschecks it on commit).docs/accordingly.## UnreleasedinCHANGELOG.md. (n/a: the title and docs/authentication.md say it)Done questions (AGENTS.md)
GET /api/v1/audit, which agents with an admin token read too.ai.injection_checkandbridge.safe_links; the audit log itself has no switch.🤖 Generated with Claude Code
https://claude.ai/code/session_01BVez82cREgCJtFk6yHReed
Generated by Claude Code