{"asOf":"2026-10-03","doesNotChangeDepotPicks":true,"doesNotChangePriceSort":true,"doesNotChangeFreeIndex":true,"note":"Classification and failure modes are mechanisms. Case studies are included only when the source URL was fetched on 2026-10-03. A capability ceiling is not a company incident. Vendor figures are labeled as that vendor's report.","id":"security-review","name":"Security review agent","definition":"Reads a change or a trace for secrets, overly broad permissions, and untrusted text copied into a tool prompt. It does not produce an attack.","needs":{"jtbdIds":["prompt-injection-firewall","llm-input-guardrails","runtime-llm-firewall","adversarial-red-team-evals","agent-secrets","secret-rotation-automation","diff-aware-pr-review"],"freeKinds":["free_docs","dev_tool"],"capabilityTags":["safety"],"plain":["A findings list with file and line, not a payload","Secrets detected are redacted in the report"]},"failureModeIds":["prompt-injection","over-refusal","eval-contamination","weak-verification"],"exampleTasks":["List secrets and broad permissions in a diff","Flag a prompt that concatenates fetched page text into a tool instruction, without quoting an attack"],"failures":[{"id":"prompt-injection","name":"Prompt injection","whatGoesWrong":"Untrusted text, including text from a page, file, or message the agent fetched, changes the agent's behavior away from the user's task. OWASP distinguishes a direct injection in the user's own prompt from an indirect injection in outside content. Neither form is fully removed by retrieval or fine-tuning, according to the OWASP LLM01:2025 page fetched today.","howToDetect":"Compare each tool call to the original user task. If the call only makes sense given text that arrived from a fetched page, file, or message, stop and ask. Record which source the instruction came from. This catalog does not store payloads or attack steps.","classIds":["browser","computer-use","research","support","personal-assistant","security-review","sales-outreach"],"sourceUrls":["https://genai.owasp.org/llmrisk/llm01-prompt-injection/","https://www.anthropic.com/news/developing-computer-use","https://simonwillison.net/2023/Apr/14/worst-that-can-happen/"]},{"id":"over-refusal","name":"Over-refusal","whatGoesWrong":"The agent declines a task the written policy allows, or declines so often that the job never finishes.","howToDetect":"Log refusals separately from successes. Review a sample against the written policy. Do not treat a refusal as a pass, and do not weaken a safety check to raise the pass rate.","classIds":["support","security-review","voice","browser"],"sourceUrls":["https://openai.com/index/introducing-operator/"]},{"id":"eval-contamination","name":"Eval contamination","whatGoesWrong":"A score is not comparable to the one it is cited against: the gold label or the issue text leaked into the prompt, the harness rejects a valid fix, or a revised benchmark is treated as the old one.","howToDetect":"Keep gold labels out of the agent prompt. Store the harness version beside the score. Do not compare a number across a benchmark revision without saying the revision changed.","classIds":["eval-judge","coding","rag","security-review"],"sourceUrls":["https://openai.com/index/introducing-swe-bench-verified/","https://os-world.github.io/"]},{"id":"weak-verification","name":"Weak verification","whatGoesWrong":"The run is marked successful because the agent said it was done, without an execution check, a test, or a second pass.","howToDetect":"Success requires an end-state check the agent does not grade for itself: tests, a database diff, or a separate judge that cannot see the gold label.","classIds":["coding","eval-judge","orchestrator","support","security-review"],"sourceUrls":["https://arxiv.org/abs/2503.13657","https://arxiv.org/abs/2310.06770"]}],"caseStudies":[{"id":"anthropic-computer-use-2024","title":"Developing a computer use model","year":2024,"studyKind":"vendor_writeup","classIds":["computer-use","security-review"],"failureModeIds":["prompt-injection"],"lesson":"Anthropic's post says computer use was in public beta and names prompt injection as a case where instructions in content can override prior directions or cause actions that were not the user's intent. It notes that a model reading screenshots from an internet-connected computer can be exposed to that content. The lesson stored here is to treat screen text as untrusted. The post's attack detail is not copied.","sourceUrl":"https://www.anthropic.com/news/developing-computer-use","asOf":"2026-10-03","notes":"datePublished on the fetched page is 2024-10-22. No procedure is stored."},{"id":"willison-prompt-injection-2023","title":"Prompt injection: What's the worst that can happen?","year":2023,"studyKind":"mechanism_study","classIds":["personal-assistant","browser","security-review"],"failureModeIds":["prompt-injection","confirmation-skip"],"lesson":"The post explains that a tool-using assistant which reads untrusted text, such as email or a web page, can be driven to take an action the user did not ask for, including sending mail or reaching data through a connected tool. The lesson for an assistant is to treat fetched text as untrusted and to require confirmation before a send or an export. Attack sketches from the post are not stored.","sourceUrl":"https://simonwillison.net/2023/Apr/14/worst-that-can-happen/","asOf":"2026-10-03","notes":"Fetched the 14 April 2023 post. Hypotheticals in the post are not reproduced and are not marked as incidents that Depot verified."}]}