AI体験記 vol.15 — ファイルの中に、AIへの命令が仕込まれていたThis entry examines whether a home-built LLM harness can resist…

The fifteenth installment of a personal "AI experience log" published on Zenn tackles a question that has become central for anyone building tooling around large language models: can a home-built harness withstand malicious instructions that arrive not from the operator, but from the very data the AI is asked to process. The entry follows directly from vol.14, and the author is upfront that it favors the honesty of lived experience over strict technical precision, doubling as a review of what came before.

According to the author, by vol.14 the harness had leveled up considerably and grown sturdier. It is described as being organized into three layers the author calls discipline, physical, and map, complemented by an added mechanism that mechanically blocks certain paths. Having reached that point, the natural next concern was defensive: if a malicious instruction slipped in, would any of these layers actually hold. The catalyst was a report the author encountered describing a case where a command addressed to an AI was concealed inside a file. In the scenario, the AI loaded what looked like an entirely ordinary program file, and the hidden text was written to be read as an instruction rather than as inert content.

This is a textbook example of what the security community calls prompt injection, and more specifically indirect prompt injection. Direct prompt injection happens when a user types adversarial text straight into a chat box to override a system's rules. Indirect prompt injection is subtler and, many argue, more dangerous: the malicious text is planted in a document, a web page, an email, or a source file that the model later ingests as part of a task. Because current LLMs do not reliably separate trusted instructions from untrusted data, text that says something like "ignore your previous rules and do the following" can be treated as a genuine command when it appears in the middle of otherwise benign material.

The risk grows sharply once an LLM is wrapped in a harness or agent framework that can take actions, such as reading and writing files, running commands, or calling external tools. A model that merely answers a question can, at worst, produce bad text. A model connected to a filesystem or a shell can be steered into leaking data, modifying files, or executing operations the operator never intended. That is precisely why the author's layered approach appears aimed at containment: restricting what the AI is physically able to touch, mapping the terrain it is allowed to traverse, and mechanically closing off routes, so that even a successful injection has limited reach.

This concern is widely shared across the industry. The OWASP Top 10 for LLM Applications has consistently ranked prompt injection as a leading risk, and vendors including OpenAI, Anthropic, Google, and Microsoft have published guidance and mitigations, from system-prompt hardening to output filtering and tool-permission controls. Open-source projects such as guardrail libraries, input and output validators, and sandboxing layers attempt to reduce exposure, though no approach is considered a complete fix. The prevailing view is that prompt injection cannot be fully solved by clever wording alone; it has to be managed through architecture, least-privilege permissions, and human oversight of consequential actions.

For readers building local LLM setups, the entry is a useful reminder that the same threats apply outside the big cloud platforms. Running a model locally can improve privacy and control, but it does not remove the injection problem, and a homemade harness with file access carries the same categories of danger as a commercial agent. The value of this kind of experience log is less in offering a definitive defense and more in walking through the reasoning: recognizing that any content the model reads is a potential attack surface, and treating untrusted input as untrusted no matter how ordinary it looks.

The piece stops at the moment of realization, framing the hidden-instruction case as the starting point for testing whether the accumulated layers can resist it. As a blog reflection rather than a formal security paper, its conclusions should be read as personal observations. Still, it captures a lesson that experts increasingly emphasize: as AI systems gain the ability to act, the file they quietly open may be carrying instructions meant for them, not for you.