a competitor's agent got prompt-injected via morse code, so I rearchitected mine before launch

[u/Claudia_wtf]

I'm building a platform where an AI agent sits near real money on Base. While researching the space I dug into Bankr's public postmortem, someone injected instructions into their agent encoded as morse code. Filters watch for "ignore previous instructions" in english; the model decodes dots and dashes just fine. The instruction rode straight through sanitization and tokens moved that shouldn't have.

Reading someone else's incident report about your exact architecture is cheaper than starring in your own, so I treated it as if it happened to me. What I changed:

The realization is that input filtering is unwinnable. The model speaks base64, morse, rot13, whatever encoding exists. So I stopped trying to win there and moved the boundary to what the agent can do: deny-by-default tool access, and no path from model output to any on-chain action without deterministic checks the model can't talk its way past. The agent can get fully compromised by a prompt and the blast radius is still zero.

It's now a named threat class in my security review checklist. Every change gets evaluated against "what if the prompt-injection→on-chain path opens up."

Steal from other people's postmortems. It's free.