TAB-1104: hide caller data from the model (fill by key at the sink)#596
Merged
Merged
Conversation
…TAB-1104)
Caller data was JSON-rendered into the task prompt, so the model could read a secret and place it into a goto/tabstack URL or done(). Render only the data KEYS; add fill_user_data(ref, key) which substitutes the value at the browser sink and never returns or emits it (only a {{key}} mask). It runs the same assessFill gate as regular fill and records agentFilledRefs (never approvedRefs), so it cannot fill caller data into fields on untrusted hosts. The model never holds the value, so it cannot exfiltrate it regardless of domain or encoding. Keys-only prompt, hasUserData threaded into the tool list and step-error prompt, select/checkbox mapping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Caller
data(from/v1/automate) wasJSON.stringify'd into the task prompt (prompts.ts{{ data }}), so the model could read a secret and place it into agotoURL, a Tabstack URL, ordone(). Hiding the value is the root fix — the model cannot leak what it never sees.Change
prompts.ts: render only the data KEYS, not values;buildTaskAndPlanPrompttakesdataKeys;hasUserDatathreaded into the tool list and the step-error feedback prompt.fill_user_data(ref, key)tool (in webActionTools): resolvesdata[key]and substitutes it atbrowser.performAction; the value is never returned or emitted (only a{{key}}mask).assessFillgate as regularfill(blocked on untrusted hosts) and recordsagentFilledRefs/operationalRefs— neverapprovedRefs, so the form-submit gate still applies.webAgent.ts: passdatato the tools; pass keys (not values) to the prompt.Why hide, not scrub
Detecting the secret in an outbound URL is a blocklist — encoding/param/method evade it. The model never receiving the value is structural: no domain, encoding, or sink matters.
Testing
fill_user_dataunit tests: blocked on untrusted host (noperformAction,SECURITY_BLOCKED_UNAUTHORIZED_FILL), allowed on trusted host (value masked, ref inagentFilledRefsnotapprovedRefs), unknown key, select field,BrowserException.goto.Complements #595 (destination allowlist). Related: TAB-1104.