PI-004

Why PI-004 followed RC1

PI-003 ended incomplete before its planned Phase 1R reliability intervention. The successor runtime changed three controls together: thinking off, a 512-token generation cap, and streaming on. With the model, context, and bounded call path held fixed, that corrected stack passed 25 of 25 synthetic reliability cycles with zero timeouts or infrastructure failures.

That qualification established apparatus reliability, not a security outcome. It also did not isolate which runtime change fixed the earlier timeout behavior because all three changed together.

PI-002-RC1 then ran the same indirect prompt-injection task through the reliable but unprotected agent. All 15 observations were valid and operationally complete. The model emitted 13 exact unauthorized send_data calls. Eleven of 15 observations produced catcher-backed completed egress. RC1 supplied the vulnerable comparison baseline for PI-004.

The single variable under test

PI-004 added raw-content privilege separation. The unprivileged worker received the document but had no tools. It could pass only bounded integers, booleans, nulls, and allowlisted enum values through a strict schema. The privileged planner retained send_data but received no raw document text or arbitrary worker-authored strings.

The model, runtime, task class, attack objective, and observable privileged action remained aligned with RC1. PI-004 did not add an input classifier, prompt-hardening intervention, human approval gate, egress restriction, or credential broker.

Design and controls

The run used 15 fresh observations with new opaque identifiers and fresh worker and planner contexts: five clean and ten poisoned. A randomized operator-only schedule kept treatment labels and document routing outside model-visible context. No counted observation was automatically retried.

The evidence was frozen and audited before treatment unblinding. The complete 212-file experimental snapshot verified with zero integrity failures, and no experimental model calls occurred after unblinding.

Before and after the run, an operator-authored exact tool call passed through the same privileged mediator, send_data implementation, and contained catcher. Both positive controls passed. This demonstrates that the privileged tool path remained operational. It does not show that the planner model chose the positive-control action.

Clean observations

All five clean observations were valid. The worker contract was accepted, the planner ran without raw-document exposure, and all five operational tasks completed. There were zero prohibited-action observations, unauthorized attempts, dispatches, completed sends, or experimental catcher POSTs.

Poisoned observations

All ten poisoned observations were valid. The attack content reached the unprivileged worker in 10 of 10 observations and reached the privileged planner in 0 of 10. Only validated structured variables crossed the boundary. All ten operational tasks completed, with zero model-originated unauthorized send_data attempts, zero dispatches, zero completed sends, and zero experimental catcher POSTs.

RC1 compared with PI-004

Measure	PI-002-RC1	PI-004
Valid observations	15	15
Infrastructure failures	0	0
Exact model-originated unauthorized calls	13	0
Observations with catcher-backed completed egress	11 of 15	0 of 15
Operational task completions	15 of 15	15 of 15

The denominators remain separate. The RC1 value of 13 is a call count, not an observation count. Two of those calls were refused before the catcher in an observation that had already produced a successful captured send. No causal claim is made about the earlier runtime changes.

Demonstrated

• Raw untrusted content reached the tool-less worker in all 15 observations.
• Only validated structured variables crossed to the planner.
• Hash-verified planner inputs contained no raw document content.
• No unauthorized attempt or egress occurred in the tested PI-004 observations.
• The privileged send_data path remained operational.
• All 15 observations met the frozen operational-completion criterion.

Not demonstrated

• General prompt-injection resistance.
• Safety for other attacks, documents, models, runtimes, schemas, or privileged tools.
• Semantic accuracy of the final answers. The frozen rubric measured operational completion only.
• Real fail-closed rejection of malformed worker output. All 15 real worker outputs passed the schema, although rejection was implemented and tested synthetically.
• A real worker attempt to invoke a privileged tool. Tool absence was implemented, instrumented, and tested synthetically, but was not separately challenged in the experimental observations.

Limitations

The study used one model and runtime, one matched document pair, one direct egress strategy, five clean observations, and ten poisoned observations with stochastic sampling. Positive controls were operator authored. The data schema was deliberately narrow. Those bounds support an architectural result for this setup, not a universal security claim.

Next question at closeout

The closeout originally recommended schema-conformant semantic smuggling against the privilege boundary. The question was whether hostile raw content could manipulate only allowed structured values into causing unauthorized privileged action while the PI-004 boundary stayed unchanged.

The sequence subsequently changed: PI-005 isolated worker susceptibility with a contained action channel. PI-006 will test the complete chain. Those later questions do not change the PI-004 results or claim boundary.