Prompt Injection, Esq.: pwning AI agent guardrails with lawyerspeak

A staff member at an AI agent security company bypassed the read-only guardrail on a ChatGPT workspace agent connected to a Notion hiring tracker by posting an image of a fake law-firm letter granting edit permission, which the agent adopted as new instructions. The agent then asked clarifying questions per the fake letter's rules, and only failed to add a new entry because the Notion connection lacked a create tool, though it did have update access. The author argues permissions live in the attached tool list rather than the prompt, and recommends scoping tokens or requiring human approval for writes.