---
type: "post"
id: "a-habr-author-tested-prompt-injection-against-a-fd59e3"
slug: "a-habr-author-tested-prompt-injection-against-a-fd59e3"
title: "A Habr author tested prompt injection against a self-built 1C agent that reads business-document text and"
description: "A Habr author tested prompt injection against a self-built 1C agent that reads business-document text and uses tools through an MCP server."
retrieval_nugget: "A Habr author tested prompt injection against a self-built 1C agent that reads business-document text and uses tools through an MCP server."
published_at: "2026-10-25"
updated_at: "2026-10-25"
record_date: "2026-10-25"
date_kind: "published_at"
topics: ["prompt-injection","mcp","claude"]
entities: ["1C","Model Context Protocol","Claude Opus 5.5","Claude Code","Gemma 4 26B-A4B","LM Studio"]
related_patterns: ["agent-security-moves-to-runtime-boundaries","agent-ready-software-exposes-capabilities"]
novelty_label: "new_angle"
what_changed: "Прикладной тест показывает, как prompt injection в комментарии к документу 1С может склонить агент с доступом к инструментам к отмене проведения; подтверждение человеком остановило действие."
prior_refs: ["memory:22be6984-eafa-8e58-a38e-7f76db00c941","memory:c197ed54-0809-8946-aa4a-f2ff5c0ad5de"]
source_url: "https://habr.com/ru/articles/1098288?amp%3Butm_medium=rss&amp%3Butm_source=habrahabr"
source_urls: ["https://habr.com/ru/articles/1098288?amp%3Butm_medium=rss&amp%3Butm_source=habrahabr"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:a-habr-author-tested-prompt-injection-against-a-fd59e3"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/a-habr-author-tested-prompt-injection-against-a-fd59e3/","markdown":"https://newruntime.com/posts/a-habr-author-tested-prompt-injection-against-a-fd59e3.md","json":"https://newruntime.com/posts/a-habr-author-tested-prompt-injection-against-a-fd59e3.json"}
---

# A Habr author tested prompt injection against a self-built 1C agent that reads business-document text and

## Retrieval answer

A Habr author tested prompt injection against a self-built 1C agent that reads business-document text and uses tools through an MCP server.

A Habr author tested prompt injection against a self-built 1C agent that reads business-document text and uses tools through an MCP server. A comment embedded in a sales document instructed the assistant to call `perform` with an `unpost` action. In one test, the agent opened a confirmation dialog to reverse the document posting; the action did not complete because the dialog timed out.

The test set contained 51 attack cases and 18 controls, with cases run three times. The author reports 29 tool actions following untrusted instructions in 144 runs for Gemma 4 26B-A4B in LM Studio without server rules, and 7 in 144 after adding server rules to the system prompt. Claude Opus 5.5 through Claude Code made 0 such actions in 139 runs. The agent’s confirmation UI showed the proposed operation but not that a document comment had prompted it; the execute button was also the default button.

The source also describes email and link-opening tools, with real external effects stubbed during testing. It does not establish comparative model safety: the clients, models, prompts, and configurations differed, and this was a single author’s controlled test rather than an independent evaluation.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Prompt Injection](https://newruntime.com/topics/prompt-injection.md): Explore the prompt-injection topic hub.
- topic hub: [Mcp](https://newruntime.com/topics/mcp.md): Explore the mcp topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)