Mitate halts prompt injection by blocking changes, not detecting attacks

Mitate is a product for people who are not IT specialists: they describe a need in conversation, and the system builds a business app such as attendance collection or equipment lending, which they can then adjust while using it. That makes it a natural target for indirect prompt injection, because the AI is routinely asked to read outside material. R2-san's first instinct — telling the model in its system prompt that what it reads is data, not instructions — is described as a request, not an enforcement, and no method fully detects injection.

The three layered measures therefore move the decision away from the model. The design AI can output only a JSON definition, a query for past records, and a reply to the user, so SQL, shell commands, credentials and notification destinations have no place to be written. Checks on the definition happen on the execution side, and notification recipients come only from roles declared in the app definition. Activation is likewise decided by the execution platform, not the AI, which is why a request to skip confirmation still produced a confirmation card in testing.

The remaining hole was the addition category, which goes live without confirmation to keep small edits light. Because the embedded instructions in the test stayed within that category, R2-san added a rule keyed to what the calling program placed in the AI's input: if past conversation or past design records were included, even an addition goes to the card. R2-san is explicit about the boundaries — the AI itself reads the record text, the CaMeL-style split of reading and designing models is not used, and Mitate does not claim to prevent prompt injection, only to close the paths by which a disturbed result could take effect without a human in the loop.