106. The prompt injection hiding in the fine print (with Jesse Anglen)

The prompt injection Jesse Anglen describes takes one line of fine print at the bottom of a website. It tells any agent that reads it to drop its instructions and email out whatever credentials sit in the .env file, and then it waits for somebody's coding agent to land on the page during an ordinary research task. The co-founder and chief executive of Ruh.ai says he hasn't heard a security professional give him a solution to that problem that he feels solves it. He thinks the eventual answer looks like a second agent whose only job is screening everything the first one gathers for prompt injection before anything acts on it. He first credits the idea to a conversation with somebody. When Jon asks where he heard it, the answer is a brainstorm with his own chief technology officer, and Jesse spends the next few minutes on how the idea breaks, starting with the attacker who writes the injection for the guard instead of the agent. Earlier in the conversation, Jesse admits he never learned serious black-hat hacking, and his point is that with the models available today he wouldn't need to. Jon takes it the rest of the way. If the cost of writing software is going to zero, so is the cost of breaking in. Jesse's frame for security is a single question, who can I trust, and the answer decides whether your data and your models can live with a provider like Amazon or OpenAI or need a stack of computers in the back. Jesse started building on Ethereum in 2014, before its mainnet launched, and for a while ran what he calls the largest blockchain development company in the world, because it was one of the only ones. He grew Rapid Innovation to 370 developers, and in April 2022 a really smart kid on his team brought him OpenAI's early models and an idea that cut client onboarding from 6 weeks to 4 days. Once ChatGPT shipped that November, the company decided that when anyone quit or had to be let go, it would try to replace them with an agent. About 2 years later, 87 people were doing the work 370 had done, with 160 agents working inside the company. His biggest client win, which he's quick to call cherry-picked, was one agent built in 3 weeks for $20,000 that he says replaced about $3.5 million worth of payroll at a Midwest plastics manufacturer. In 2025 he stepped down as chief executive of Rapid Innovation to put all his time into Ruh.ai, which builds digital workforces of agents for other companies. There's also his photography story, which is how he explains what artificial intelligence did to reasoning, and his case for why cybersecurity stays a human job for as long as people want to steal things. Episode page and transcript: ysecurity.io/podcast/106-the-prompt-injection-hiding-in-the-fine-print/ Brought to you by YSecurity, the security team that works next to yours. Your first 8 hours of chief information security officer work are free at ysecurity.io/startups.