Hijacking AI Agents, Part 4: Catching It
Across Parts 2 and 3 these attacks looked slippery. Most of them are not. Hidden characters, override phrasing, “do not tell the user”, a secret read sitting next to a network call, a write to an instruction file: all of it shows up in the raw bytes if you know what to grep for. This part is how I build that scanner, and the one step that makes or breaks it. Normalize Before You Match This is the whole game: normalize Unicode and strip the invisible characters before you match anything. ...