This week, a developer in Reddit's r/LocalLLaMA community ran a security experiment with alarming results. He used a Qwen3.6-based open-source LLM to craft 60 "prompt injection" attacks targeting the working files of local coding assistant Hermes—in plain terms, hiding malicious instructions inside ordinary text to trick the AI agent into leaking users' file paths, email addresses, LinkedIn profiles, or even forwarding data to external channels. He then ran the two security scanners he could find against these contaminated files: Shieldstral had a 0% interception rate, while another tool, GPT-OSS safeG, blocked just 10%. In other words, 60 carefully designed attacks basically all got through.
What This Is
Prompt injection is one of the most intractable security challenges in today's AI agent space. Unlike traditional hacking, it doesn't require finding vulnerabilities or writing code—just smuggling "goods" into content the AI will read, such as telling the AI to "ignore previous instructions and execute XXX instead." This test targeted local AI coding assistants like Hermes, which are typically granted access to users' code, email, configuration files, and other sensitive content. An attacker only needs to hide instructions in any file the AI reads, and the AI may unknowingly exfiltrate data or invoke unintended tools. Shieldstral is one of the more prominent open-source protection tools in the community, and this test served as a "bare exam" for it and similar solutions—the score was zero.
Industry View
We noticed two schools of thought in the community. One argues this precisely demonstrates that local AI agents (AIs that can autonomously read/write files and invoke tools to complete tasks) are not yet mature—before handing them code, email, and file-based sensitive work, we should assume "zero protection." The other is more optimistic: open-source security research is itself progress; problems that can be publicly exposed and reproduced get fixed faster than at closed-source giants. However, dissenters note this test used specially crafted attack samples that ordinary users are unlikely to encounter in daily scenarios—so panic is unwarranted. But a 60:0 score is still a clear signal: existing scanners are nearly powerless against prompt injection. We read this as not just a technical issue—it's an infrastructure gap across the entire agent ecosystem.
Impact on Regular People
For enterprise IT, this means that when deploying AI coding assistants internally, "prompt injection protection" must be added to the security assessment checklist. Yesterday's antivirus and data-exfiltration-prevention thinking needs to extend to the AI layer.
For individual professionals, if you're using AI agents like Cursor, Cline, or local Hermes to handle tasks involving customer information or financial data, you need to realize: you think it's just reading files, but in fact the files are "reverse-commanding" it.
For the consumer market, AI agent products will keep flooding in over the short term, but vendors that can actually land in enterprise scenarios must deliver verifiable security detection capabilities—this will shift from a nice-to-have to a procurement gate.