A defensive publication (public prior art) by Gus IT LLC.
A minimal, retrofittable injection-to-RCE containment loop for tool-using AI agents that accept untrusted file attachments.
This repository is a technical defensive publication: a dated, enabling public disclosure whose purpose is to establish prior art over a specific security mechanism so that it remains freely practicable by everyone and cannot be removed from the public domain by a later patent.
It documents — and demonstrates with runnable, dependency-free reference code — a containment loop that stops prompt-injection-to-remote-code-execution (injection→RCE) in AI agents that can both (a) ingest untrusted document/image attachments and (b) call mutating tools like write_file and run_command.
The core idea in one sentence: any turn that carries a new untrusted attachment is automatically downgraded to read/vision-only for that turn — the mutating tools are hard-denied regardless of the caller's role, and re-enabled on the next attachment-free turn.
- Turn-scoped tool downgrade keyed on input taint. Taint is evaluated per turn from the newly introduced attachments. On a tainted turn the mutating tool set is subtracted — even for an admin whose RBAC would auto-allow exec. The downgrade lifts automatically on the next clean turn. Scope is exactly one turn.
- Re-hydration re-enveloping. The untrusted-content envelope (a non-forgeable fence + a "this is data, not instructions" note) is re-applied on every re-hydration of a historical attachment, so poisoned content cannot launder itself trusted through compaction or replay.
- Pre-flight token rejection. An over-budget turn is rejected (413) before any provider call, so the rejection is free rather than billing the offending request.
- Attachment-to-execution provenance join.
attachment_idsare stored on both the message row and each tool-execution row, so any executed — or denied — side-effect joins back to the exact file that may have induced it. Denied attempts are retained as an injection-attempt ledger.
The two defensible specifics — re-enveloping on re-hydration and the two-row provenance join — are exactly what this disclosure dates and enables to keep in the public domain.
The agent-security patent landscape is active and rising. Broad claims over "restricting an AI agent's actions based on the trust of its input" are foreseeable. Publishing this mechanism as enabling prior art, with a working reference, bars its enclosure and lets any team adopt it freely.
| Path | What |
|---|---|
DEFENSIVE-PUBLICATION.md |
The full ~5,000-word disclosure: problem, mechanism, data model, worked example, prior-art delta, claim-style prose, appendices |
docs/FIGURES.md |
The Mermaid diagrams with captions |
docs/PRIOR-ART.md |
Real references, a delta table, and the honest novelty nub |
docs/OPEN-SOURCE-APP.md |
How the reference maps to a deployable open-source app + a Kubernetes/AKS sketch |
src/ |
Clean-room, dependency-free, offline-runnable Node.js (ESM) reference implementation |
src/README.md |
Notice on the illustrative nature of the code + a files table |
cd src
node example.jsNo network, no credentials, no real model — every provider/tool/storage effect is an injected stub. The script asserts each disclosed invariant (poisoned turn denies run_command for an admin; clean follow-up re-enables tools; re-hydration re-envelopes; over-budget rejects before any provider call; the denied execution joins back to its file) and exits non-zero if any fails.
Dual-licensed:
- AGPL-3.0-or-later for open-source use. You may use, study, modify, and redistribute under the terms of the GNU Affero General Public License, version 3 or later.
- Commercial license available from Gus IT LLC for use in closed-source or otherwise AGPL-incompatible products.
For commercial licensing or questions: gus@gusit.de.
The prose disclosure is released as enabling public prior art; the reference code is licensed as above. See LICENSE for full terms.
Gustavo Assuncao, PhD. Taint-Triggered Turn-Scoped Tool Downgrade with Attachment-to-Execution Provenance Audit. Defensive Publication v1.0, Gus IT LLC (Florida, USA), 2026-07-03.
Published 2026-07-03 · Gus IT LLC (Florida, USA) · Author: Gustavo Assuncao, PhD