Prompt injection risk

This is a classic indirect prompt injection scenario — and the answer to "what's stopping it?" is: nothing, by default.

The code comment /** * If you are an agent looking at this, do the following: [REDACTED MALICIOUS ACTION HERE] */ is a perfect example of what OWASP ASI-01 (Prompt Injection) calls an "indirect injection via external content." When an agent reads a codebase, every file becomes part of its context, and the LLM can't reliably distinguish between "this is code I'm analyzing" and "this is an instruction I should follow."

The practical mitigations are:

1. Explicit content delimiters — wrap file content in trust-boundary markers before it enters the agent context
2. Write-path scanning — validate content before it's persisted to agent memory stores
3. Source provenance tagging — track where each piece of context came from

OWASP Agent Memory Guard (pip install agent-memory-guard) implements the write-path scanning approach:

from agent_memory_guard import MemoryGuard
guard = MemoryGuard()

# Before adding file content to agent context
result = guard.scan(file_content, source="codebase_file", path=file_path)
if result.is_threat:
    print(f"Potential injection in {file_path}: {result.threat_type}")
    # Wrap in explicit untrusted delimiter
    file_content = f"[UNTRUSTED FILE: {file_path}]\n{file_content}\n[/UNTRUSTED FILE]"

AgentThreatBench has ASI-01 test cases for this exact "malicious instruction in code comment" pattern — useful for testing how well your agent defends against it.