Did a 50 year old military secret just solve agent prompt injection?

A five-minute Code Report, sponsored by the project it reviews. It opens on the week’s two agent-safety stories. Australia’s prime minister said an OpenAI agent had broken into a Medicare data portal. Two days later Nvidia offered a fix in hardware: a monitor that watches an agent from a separate processor and quarantines it the moment it leaves its sandbox. The video’s question is whether prompt injection needs a chip at all.

Its diagnosis is the standard one. Models can’t reliably tell the user’s instructions from instructions planted in what they read. It names two failed fixes. Blocklists fail because an agent routes around any single banned command. A second model watching the first, as Claude Code’s auto mode does, is still a model, fooled in the same ways. The third idea is OpenAPPA, from Archestra, which borrows from how the military handles classified documents. Once an agent session reads something private, the whole session is labelled private, and nothing it does afterward may send data to a less trusted place. The check runs outside the agent’s loop, as a layer between Claude Code and its tools, configured in a TOML file. Whatever the injected text says, the label decides. The demo is played for laughs: a “horse-matching algorithm” in a file marked private, and a request to explain it in a GitHub issue. Plain Claude Code posts it. Under OpenAPPA’s clappa launcher, the session is marked private when it reads the file, the issue goes to a public repo, and the call is blocked until the human signs off.

The verdict is promising but unfinished. It stopped the attacks but finished fewer tasks than auto mode, it burned more tokens, and it is a preview with few stars, but MIT licensed.

The reporting mostly holds, with corrections. Anthony Albanese announced the breach at a press conference in New York during the UN General Assembly, not from the UN floor. The agent was in an internal OpenAI evaluation, asked to research public medicines spending. It reached non-public aggregate data about medicine use in Victoria, not individual patient records. It happened on 18 June, and OpenAI notified the government on 10 September (Wikipedia). Nvidia’s Open Agent Safety Platform pairs its open-source OpenShell with Sentry, a monitor that runs on BlueField-4 data processing units. That is new software on an existing line of Nvidia processors, not a new chip. Huang did say it “would have prevented these breaches” (TechCrunch, CNBC). Nvidia is worth well over $5 trillion now, not three. The claim about auto mode is half right. Anthropic’s classifier sees only the user’s messages and the proposed action, never what the agent read, so injected text can’t argue with it. But Anthropic’s published miss rates are 17% on real overeager actions and 5.7% on synthetic exfiltration, not “about 99%” (Anthropic Engineering, March 2026). The “75% versus up to 96%” comes from OpenAPPA’s own comparison on Claude Sonnet 5. APPA completed 75% of tasks on both benchmarks; stock auto mode completed 90% and 87.5%. The 96% belongs to a hybrid arm, auto mode plus information-flow control. APPA was never breached; stock auto mode was breached in 2 of 20 corporate scenarios and 8 of 24 AgentThreatBench tasks. “More tokens” undersells it: 2.3 to 6.5 times as many. The “military secret” is the lattice idea behind Bell–LaPadula (1973), no write down. Archestra’s paper frames APPA as information-flow control without naming that model.