{"schema_version":"0.10.0","id":"LR-2026-0371","record_version":1,"title":"Prompt injection leads to simulated /etc/passwd disclosure","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":43.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"2aa249b43b6ed10302525a12c91e982007f3d7cfe2cae6dc038774c666baa691"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":"answer policy- and process-related questions only","safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-01-25","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"prompt_injection","duration":null,"detection_method":"unknown","summary":"The Resecurity write-up presents a practical proof of concept in which an AI-powered HR assistant, designed to answer policy and process questions only, was steered by a prompt injection attacker into behaving as if it had local system access. The attacker first framed the assistant as an internal Linux support tool, then introduced a troubleshooting scenario, and finally asked it to read /etc/passwd. The article states that this tests whether the model enforces its lack of filesystem access instead of hallucinating or simulating sensitive data. The scenario shows how role confusion and gradual trust escalation can lead an assistant to produce sensitive-looking output without real system access. The source does not report a detection or response. Its recommendations include least-privilege access, output validation, human approval for high-risk actions and adversarial testing.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK01","control_chain":[{"layer":"L2","party":"harness_vendor","party_name":null,"control_id":"C3","outcome":"missing","reason":null,"quote":"Then unsafe output reaches the user unchecked.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["B1"],"quote":"Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["A1"],"quote":"Restrict the model’s access privileges to the minimum necessary for its intended operations.","source_index":0,"reviewed":false},{"by":null,"kind":"advice","date_reported":null,"controls_added":["C3"],"quote":"Specify clear output formats, request detailed reasoning and source citations, and use deterministic code to validate adherence to these formats.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"negligible","severity_because":"negligible: no effect beyond the system itself; the scenario is simulated, even without real system access","harm_class":[],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.resecurity.com/blog/article/breaking-trust-with-words-prompt-injection-leading-to-simulated-etcpasswd-disclosure","publisher":"Resecurity","date":"2026-01-25","type":"press","title":"Breaking Trust with Words: Prompt Injection Leading to Simulated /etc/passwd Disclosure - Resecurity","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.intended_use":"C","event.incident_class":"C","event.trigger":"C","impact.severity_because":"D","impact.severity":"D","event.primary_risk":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.detection_method":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.intended_use":[{"source_index":0,"quote":"An organization deploys an AI-powered HR system designed to answer policy- and process-related questions only."}],"event.incident_class":[{"source_index":0,"quote":"Prompt Injection is a type of cyberattack against Large Language Models (LLMs)."}],"event.trigger":[{"source_index":0,"quote":"However, an attacker attempts to manipulate the conversation by framing technical requests and tricking the system into behaving as if it has local system access, such as revealing /etc/passwd."}],"impact.severity_because":[{"source_index":0,"quote":"The simulated /etc/passwd disclosure scenario demonstrates how social engineering, role confusion, and instruction-following bias can cause an AI system to hallucinate capabilities or expose sensitive-looking information, even without real system access."}],"impact.severity":[{"source_index":0,"quote":"The simulated /etc/passwd disclosure scenario demonstrates how social engineering, role confusion, and instruction-following bias can cause an AI system to hallucinate capabilities or expose sensitive-looking information, even without real system access."}],"event.control_chain":[{"source_index":0,"quote":"Then unsafe output reaches the user unchecked."}],"event.remediations":[{"source_index":0,"quote":"Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions."},{"source_index":0,"quote":"Restrict the model’s access privileges to the minimum necessary for its intended operations."},{"source_index":0,"quote":"Specify clear output formats, request detailed reasoning and source citations, and use deterministic code to validate adherence to these formats."}],"event.summary":[{"source_index":0,"quote":"An organization deploys an AI-powered HR system designed to answer policy- and process-related questions only."},{"source_index":0,"quote":"However, an attacker attempts to manipulate the conversation by framing technical requests and tricking the system into behaving as if it has local system access, such as revealing /etc/passwd."},{"source_index":0,"quote":"The attacker begins by framing the AI as an internal Linux or IT support assistant."},{"source_index":0,"quote":"This tests whether the model understands and enforces its lack of filesystem access instead of hallucinating or simulating sensitive data."},{"source_index":0,"quote":"The simulated /etc/passwd disclosure scenario demonstrates how social engineering, role confusion, and instruction-following bias can cause an AI system to hallucinate capabilities or expose sensitive-looking information, even without real system access."},{"source_index":0,"quote":"Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions."}]},"notes_on_gaps":"The source is a vendor blog post describing a practical proof of concept with a hypothetical HR assistant, not a documented real-world incident. The organization, model, developer, harness, tools, and deployment context are not named or stated. No date of occurrence, detection date, or detection method is given; the publication date (2026-01-25) appears only in the source header, not in a quotable sentence, so date_disclosed is left out. No duration, containment, loss, record, or affected-party figures are stated. Judgements made: incident_class set to security_compromise and trigger to prompt_injection based on the article's framing of the attack; root_cause set to guardrail from the article's conditional statement, which is not confirmed for this scenario; severity set to negligible because the scenario is described as simulated with no real system access. Controls and remediations are generic recommendations in the article and are cited as advice only. The article's introduction mentions a Fortune 100 customer incident, but no details of that incident are given, so it is not recorded. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"An AI-powered HR assistant answers policy and process questions for an organization.","quote":"An organization deploys an AI-powered HR system designed to answer policy- and process-related questions only.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"An attacker tries to manipulate the conversation so the assistant behaves as if it has local system access.","quote":"However, an attacker attempts to manipulate the conversation by framing technical requests and tricking the system into behaving as if it has local system access, such as revealing /etc/passwd.","source_index":0,"grade":"C"},{"step":"reached","text":"The attacker explicitly asks the assistant to read the /etc/passwd file.","quote":"The attacker explicitly asks the AI to read /etc/passwd, a well-known Linux system file containing user account information.","source_index":0,"grade":"C"},{"step":"done","text":"The scenario is simulated and shows the assistant could expose sensitive-looking information without real system access.","quote":"The simulated /etc/passwd disclosure scenario demonstrates how social engineering, role confusion, and instruction-following bias can cause an AI system to hallucinate capabilities or expose sensitive-looking information, even without real system access.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.resecurity.com/blog/article/breaking-trust-with-words-prompt-injection-leading-to-simulated-etcpasswd-disclosure"]},"analysis":{"sections":{"timeline":[{"text":"Step 1: the attacker frames the AI as an internal Linux or IT support assistant.","quote":"The attacker begins by framing the AI as an internal Linux or IT support assistant.","source_index":0,"when":null},{"text":"Step 2: the attacker introduces a troubleshooting scenario about login issues.","quote":"The attacker introduces a realistic troubleshooting scenario (e.g., login issues or account verification).","source_index":0,"when":null},{"text":"Step 3: the attacker asks the AI to read /etc/passwd.","quote":"The attacker explicitly asks the AI to read /etc/passwd, a well-known Linux system file containing user account information.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.resecurity.com/blog/article/breaking-trust-with-words-prompt-injection-leading-to-simulated-etcpasswd-disclosure"]}}