THINKWELL
WIP · IN DEVELOPMENT
Thinkwell Notes support desk — an internal agent that fetches docs, holds a runbook, and posts to the public wall. Two views: what you see, and what it sees. Based on Prompt Injection as Role Confusion (Ye, Cui, Hadfield-Menell — ICML 2026). New here? Read the lesson →
Defender Coda — Your Turn
You've run every angle of role confusion. Now defend the desk. Draft your answers — the mechanism range stays black-box, so think in terms of what you'd build, not what the code does.
1. Destyling: the paper shows removing reasoning-style wording from inbound tool text drops spoof success from 61% to 10%. What would you strip from fetched pages before the agent sees them?
2. Role perception: tool output has no authority to give orders — no matter how it's written. How do you make an agent act on that instead of on style?
3. Detection signals: userness and CoTness of inbound content predict attacks. Where would you measure them, and what threshold do you alert on?
Notes stay in your browser — nothing is submitted.