Every decision is logged to a structured audit trail - giving teams full visibility into what their agents are doing, with compliance-ready reporting out of the box.
The interesting part is not the payload. It is how the attacker got the npm token in the first place: by injecting a prompt into a GitHub issue title, which an AI triage bot read, interpreted as an instruction, and executed.
，这一点在PDF资料中也有详细论述
The System Browser shows a frame, but we also need to understand the scene.
We used a modified version of Wason’s 2-4-6 task [wason_failure_1960]. Participants were told they were participating in a “rule discovery game” and that they would interact with an AI agent to discover a rule that determines a set of three numbers. The initial sequence was 2-4-6 for all participants. The true rule was: “All three numbers must be even numbers.”