The one where prompt injection still has no patch

Welcome to the first issue of hackerlogs. The format is fixed and short: one idea worth your attention, a thing you can actually run, and a piece of news read for what it teaches rather than for the headline. Primary sources are always linked. There are no sponsored placements in the body. If that ever changes, it will be labelled.

The idea: prompt injection is not a bug#

Every few months someone announces prompt injection is solved. It is not, and the reason is structural. A transformer reads one flat stream of tokens; your system prompt, the user's question, and a retrieved web page all arrive through the same channel with no enforced boundary between them. There is no escape() and no prepared statement, because natural language has no grammar that separates code from data.

That is why input filtering and better prompting move the numbers around without ever reaching zero. The defences that hold are architectural: least privilege on tools, human confirmation on side effects, treating model output as untrusted.

Read the full argument: Prompt Injection: Why There Is No Patch.

The thing you can run: an injection lab in thirty minutes#

Reading about indirect injection convinces nobody. Demonstrating it against a pipeline that looks like the one your team shipped last sprint convinces everyone in the room at once.

This issue's lab builds that demo locally: a retriever, a small model, a poisoned document, and a fake exfiltration endpoint you watch light up. Then you run the same payload against each defence in turn and record the hit rate. The naive filter blocks your first payload and fails against the second, which is the whole point.

Build it: Build an Indirect Prompt Injection Lab in Thirty Minutes.

The news, read properly: Probllama#

High CVE-2024-37032 was a path-traversal RCE in Ollama's model-pull endpoint. The bug was fixed within days. The reason it is still worth reading is the deployment: the default Docker image runs as root, binds every interface, and enforces no authentication, so an input-validation slip became unauthenticated remote code execution on the open internet.

The lesson generalises past Ollama. Self-hosted AI runtimes optimise for a fast local start, which means no auth and a permissive bind. That is fine on a laptop and dangerous on a server. When you adopt one, ask the boring questions first: what does it bind to, what auth does it enforce, what does its container run as?

The brief: Probllama: What the Ollama RCE Teaches About Self-Hosted AI.

Until next week#

If a colleague would get something out of this, forward it. If it was forwarded to you, the subscribe box is at the bottom of every page. One issue a week, one-click unsubscribe, no list-sharing. The newsletter page has the full archive.