Delta for chapter 8: P6: Prompt injection and supply-chain steering of agents (2026-10-18)
> DRAFT, machine-compiled, owner review pending. Not merged into the chapter.
Week 2026-W42. Fits the chapter: True. Model run 20261018T113036-book-delta-P6-0d05eb, $0.0235 notional.
New exemplars (candidate, reported via NVD/GitHub advisories, not independently verified):
- Roo Code command-approval bypasses. Five CVEs affect Roo Code through 3.54.0, each reportedly bypassing command approval by hiding denied commands inside allowlisted ones such as echo, with indirect prompt injection as the attack route (CVE-2026-110202). The listed techniques include command substitution next to glob characters, a bare >& redirect prefix, and ${ command; } treated as parameter expansion (CVE-2026-110203).
- IntentKit tool scoping. Through 2.6.3, the executor reportedly validates tool calls against the full registry rather than the per-request narrowed set, so owner-only tools such as wallet transfer and call-agent could run without being advertised for that request (CVE-2026-76066).
- Nginx UI MCP side door. The MCP tool nginx_config_add reportedly writes and reloads nginx config without the validation the REST flow applies, enabling authenticated RCE (GHSA-9jww-cxg5-rj9m). A separate advisory reports the OTP step-up can be bypassed through /mcp and /mcp_message (GHSA-vc32-4gwf-77xp).
Refinement and control: Steering need not change the model's behaviour; it can exploit weak enforcement downstream of the model. Controls that only filter strings or narrow what the prompt shows are not boundaries. Worth adding: enforce tool scope in the executor, and require agent-facing (MCP) paths to run the same checks as human-facing APIs.
Input material