From 20005312ba083004760005d560f97d41aeebf7ec Mon Sep 17 00:00:00 2001 From: carsonroscoe Date: Tue, 11 Aug 2026 09:13:34 -0400 Subject: [PATCH] docs: document inherent prompt injection risk AgentKit gives an AI agent a wallet, so any text reaching the model's context can influence which actions it takes, including transfers. Add a "Managing Risk" README section stating this explicitly, naming both the direct (public chat/API surfaces) and indirect (context-pulling action providers) injection surfaces, and placing responsibility for managing them on the integrating developer. Point to guardrails middleware and the guardrails chatbot example as one mitigation strategy. The section sits after the quickstarts and repository structure, since this is a pre-productionization concern rather than something needed to get started. Also note in SECURITY.md that prompt injection is not treated as a vulnerability in AgentKit itself. Co-Authored-By: Claude --- README.md | 16 ++++++++++++++++ SECURITY.md | 4 ++++ 2 files changed, 20 insertions(+) diff --git a/README.md b/README.md index 33703c4c1..a92021bdc 100644 --- a/README.md +++ b/README.md @@ -27,6 +27,7 @@ - [Node.js](#nodejs) - [Python](#python) - [🗂 Repository Structure](#-repository-structure) +- [⚠️ Managing Risk](#%EF%B8%8F-managing-risk) - [🤝 Contributing](#-contributing) - [📜 Documentation](#-documentation) - [🌙 Nightly Builds](#-nightly-builds) @@ -192,6 +193,21 @@ agentkit/ │ └── strands-agents-cdp-server-chatbot/ ``` +## ⚠️ Managing Risk + +AgentKit gives an AI agent a wallet. LLMs do not reliably distinguish instructions from data, so text that reaches the model's context can influence which actions the agent takes, including transfers. This is inherent to the design and cannot be resolved within the SDK. + +Every surface that feeds the model text increases the injection surface: + +- **Direct** — interfaces where a third party sends text to the agent, such as a public website, chat bot, or API. +- **Indirect** — actions that pull external content into context. `twitterActionProvider` returns mentions and `farcasterActionProvider` returns profile data, both as tool output the model reads. + +Either surface, combined with a funded wallet and a fund-moving action provider (`walletActionProvider` is registered by default), is sufficient for injected text to result in an onchain transfer. AgentKit does not gate transfers behind human approval, enforce spend caps, or allowlist destinations. + +By using AgentKit you accept that managing these surfaces and keeping your funds safe is your responsibility as the developer. + +Guardrails middleware is one common strategy. See the [LangChain middleware docs](./typescript/framework-extensions/langchain/README.md#middleware) and the [guardrails chatbot example](./typescript/examples/langchain-guardrails-cdp-chatbot), which combines human-in-the-loop approval for transfers with prompt injection filtering. + ## 🤝 Contributing **AgentKit is actively looking for community contributions!** diff --git a/SECURITY.md b/SECURITY.md index 35c5d7eb1..5f2ae7d5b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -4,4 +4,8 @@ The Coinbase team takes security seriously. Please do not file a public ticket d Please report your findings through our [HackerOne][1] program. +## Prompt Injection + +Prompt injection is inherent to giving an AI agent a wallet and is not treated as a vulnerability in AgentKit itself. See [Managing Risk](README.md#%EF%B8%8F-managing-risk) for the risk model and mitigations. + [1]: https://hackerone.com/coinbase