The Instructions Were Encrypted.
The Permission Was Never Asked.

GitHub’s position deserves a fair hearing. It is not obviously wrong.

Autopilot means the agent acts without asking. The user pointed it at a hostile page and handed it the keys to the machine. If you give an agent standing permission to act, then aim it at an attacker’s content, the damage is, in a real sense, what you set up. GitHub asks one question: did the user permit this? Its answer is yes. Case closed.

Adversa answers a different question. Theirs is not obviously wrong either.

The same instructions, in plaintext, were detected and refused as prompt injection. As ciphertext, decrypted inside the agent’s own code runtime, they were obeyed. The encryption did not make the instructions stronger. It made them invisible to every filter that would have stopped them. It made the agent treat the decrypted output as its own reasoning. Encryption changes how the agent interprets what it is allowed to do.

Two more details sharpen the point. In Adversa’s reported tests, Microsoft’s mai-code-1.1-flash completed the attack in about half the runs. The report does not say how many runs that was. Two GPT-5.6 models refused the same payload every time. And on one account with model selection left on Auto, the router handed out the vulnerable model on some sessions and a safe one on others. Same permission grant. Different outcome. The user never chose. The user never saw which model handled the session.

So both sides are right. But the more interesting fact is what Adversa did next.

Adversa did not stop at the disclosure. Its writeup proposes watching the full chain of tool calls with resolved arguments. Alerting on the sequence, not any single payload. Gating new network destinations and writes outside the workspace. Quarantining untrusted content in a context with no tools and no credentials. It claims its own instrumented platform stopped a reproduced chain the moment decoded attacker-controlled content headed for the network. That product claim still needs independent verification. But the governance instinct is right. And it is already in the original research. Anyone who says nobody proposed action-level protection here has not read the paper.

What Adversa’s account leaves open is a harder question. Detecting a dangerous chain is not the same as defining what authorized the action in the first place.

Four things get collapsed into one in most discussions of this attack. Keep them separate.

Autopilot changes who must approve each step. It does not change who is entitled to authorize the step in the first place. An untrusted webpage may provide data for a task; it does not inherit the user’s authority over local files and network destinations. The missing boundary is not simply between plaintext and ciphertext. It is between information the agent may process and instructions the agent is authorized to execute.

This is the confused deputy problem in agent form. A legitimate executor with real permissions gets induced by a lower-privilege outsider to act on its behalf. The agent was not hacked in the classic sense. It was handed someone else’s instructions and treated them as its own.

One caution runs the other way. A user not mentioning a file does not prove access was unauthorized. Many legitimate tasks require the agent to discover files on its own. The hard question is not “did the user name this file?” It is “why does this action belong within this task’s authorization scope, and how would we verify that?”

It also clarifies where a checkpoint can actually work.

The fix cannot be a better text filter. Plaintext filtering alone cannot establish action safety. The payload never appeared as readable text while a content filter was watching. Decrypted output and subsequent actions remain the observable part.

But “check at the tool boundary” needs the same precision. The agent’s decision layer chooses to call a shell or Python tool. A tool-call checkpoint can inspect that call. It cannot always foresee what the code does once it runs. The code inside might read files. It might open HTTP connections. The framework may see only one execute_command call. File reads and network requests inside the code stay invisible at that layer. Catching them reliably may need process isolation, file permissions, network egress controls, or other enforcement below the agent. A checkpoint at the tool boundary is necessary. It is not automatically sufficient.

Capability is not authority.

A model that can decrypt, read files, and call URLs will do all three whenever its context suggests it. Nothing in its loop checks whether the task authorized each step. An agent’s permission to act is not proof that a particular action is authorized.

At Instinctive Network, this is the question driving our work on Intent Checkpoint: how can delegated authority be represented, checked, and enforced at runtime — independently of which model happens to be acting?

Adversa’s work leans toward detecting dangerous behavior chains. The direction we are exploring is adjacent and different: how to turn human authorization, task scope, resource limits, and action evidence into judgments that can be executed and audited. That is a research position, not a claimed advantage. It will have to earn its case by being more accurate, more reliable, or able to cover situations provenance-based detection cannot.