Research: prompt injection via transcripts and ask_human answers — re-verified threat model¶

Issue: #803 (open) · Parent: #788
Date / audited revision: 2026-11-06, main @ 4695e49a
Status: design input only. No runtime change, no test run against a real client, no accepted decision. Every "proposal" below is a proposal; the companion proposed ADR remains Proposed, not accepted.
Builds on: 2026-11-03 trust-boundary audit (findings AGT-01…AGT-09), replay spec, ADR-019, ADR-020, ADR-031.

Why a second note¶

The 2026-11-03 audit was written against fa8159d8. Rounds 4 and 5 have since changed the MCP and IPC code (shared budget, stable failure text, owner-only socket, a send-to never-submits test). This note does three things the earlier one could not:

1. re-checks each earlier finding against 4695e49a and says which are closed;
2. narrows the scope to text that crosses into an agent's context — the transcribe result, the ask_human answer and refusal text, dictation into a focused agent, and logs;
3. separates mitigations present in code from gaps, each with file:line.

Evidence rule. [C] = read in source at 4695e49a; [T] = an existing test asserts it (named, not re-run for this note); [U] = unverified — no real MCP client, desktop client, microphone, speaker or OS other than source reading was used. No claim here is about how Claude Code, Codex or any other host treats the text it receives.

1. The threat in one sentence¶

YazSes turns sound into text and hands that text to something that may obey text. An attacker who can put words into audio (a media file, a video playing in the room) or into an agent-supplied question can try to get those words treated as instructions by the downstream agent, or by YazSes's own command grammar. YazSes cannot decide how a host treats a tool result; it can decide what it emits, what it reflects, and what it acts on.

2. Trust boundaries (text flows only)¶

All of B1, B3 and B4 reach the host as one undifferentiated {"type":"text"} content item (src/yazses/mcp/protocol.py:230-234). Nothing in the payload marks who said it.

3. Mitigations already in code¶

4. Gaps (each a code-path observation, not a reproduced exploit)¶

Earlier finding AGT-02 (unanswered questions are not charged) is now intended behaviour — ask.py:130-144 releases the slot and tests/test_ask_human_concurrency.py:115 asserts it. Whether that is the right accounting is the open decision in the proposed ADR, not a defect.

5. Proposals (not decisions)¶

Ordered by value per unit of risk. Each would be its own change with its own tests; nothing here changes a public interface unless stated, and those need a maintainer.

1. G1 — route ask_human failure text through the same classifier as tool failures. Smallest form: ask.py:128 uses a fixed message (or protocol._failure_text-style classification) and logs the exception to stderr. Test: a fake listener raising an exception whose message carries a synthetic path sentinel; assert the sentinel is absent from the IPC reason and from the MCP tool text. No interface change.
2. G11 — propose an ADR-019 amendment row for "returned to the MCP host over stdio": payload = transcript / spoken answer; destination = the host process; YazSes transmits nothing further. Needs maintainer acceptance; this note does not amend the ADR.
3. G4 — speak a fixed, honest requester label ("an MCP client") unless and until a caller identity can be authenticated; keep the IPC caller param for logs only. This changes spoken behaviour of an IPC method → L3, maintainer decision.
4. G6 — make the TTS contract observable: speak() signals an interrupted playback (return value or raise) so ask.py can refuse instead of listening. Test with a fake backend; real-speaker behaviour [U].
5. G2/G3 — advisory metadata: annotations (readOnlyHint: true, openWorldHint: true on transcribe), and a one-line server instructions stating that tool results are the words heard, not instructions. Purely advisory per MCP; must not be presented as a control. Changes tools/list output → maintainer.
6. G8 — measure before acting: a fuzz/property target asserting what the injector receives for decoder output containing \n, \r, \x1b. Only if a real path exists, propose a filter; a filter that alters legitimate multi-line dictation would itself be a regression.
7. G5, G7, G9, G10 — research only. Each needs a measurement (TTS length vs. accessible use; false-command rate from ambient audio during holds; decoder output containing label-like text; whether real hosts send notifications/cancelled) before any change. G7 overlaps the unintended-activation note (2026-11-05).

Explicit non-proposals: no heuristic "prompt-injection detector" that rewrites or drops the user's words; no network path; no claim that YazSes can make a host treat output as data. These stand from the 2026-11-03 audit (§4 "No-go").

6. What would change this assessment¶

• A synthetic reproduction of G1 (expected to be easy; see proposal 1).
• Real-client evidence (version × OS) of how hosts render isError, annotations or instructions — tracked with handoff/compatibility work, not here.
• A measured false-command rate from ambient audio during holds (G7).

References¶

• OWASP Top 10 for LLM Applications — LLM01: Prompt Injection — segregate untrusted content, least privilege, human approval for high-risk actions. [F]
• MCP specification 2025-06-18 — Tools — the revision this server speaks; tool results, isError, annotations as untrusted hints. [F]
• MCP blog — tool annotations (2026-03-16) — annotations are advisory, not enforceable. [F]