OpenAPPA offers a promising defense against agent prompt injection by preventing data from leaving its classification level, but it does not fully solve the problem because it reduces task completion, increases token usage, and remains in preview.
Claude Code is Anthropic's agentic coding tool for the terminal, IDEs, and GitHub. It uses natural-language commands to understand a codebase, create and read files, execute commands, run tests, explain code, manage Git workflows, and handle routine development tasks. It can also load persistent project context, run custom slash commands, use plugins with custom commands and agents, and operate with configurable autonomy while leaving actions such as final pull-request merging to a human. The official repository documents installation for macOS, Linux, and Windows, and identifies npm installation as deprecated.
OpenAPPA is an open-source security tool for agentic applications. It sits between an agent and its tools, tracking the sensitivity and trust of data the agent reads and checking every outbound action against a policy before dispatch. Its APPA (Agentic Permissions Policy Algebra) engine uses declarative TOML policies and a pure decision core based on the event log, so it can run in-process from Rust or Python or as a sidecar. The project includes integrations for Claude Code and Amp, with checks applied to tool calls and results. OpenAPPA is currently a preview and RFC, and its configuration and wire interfaces may change.
Searchable transcript of Did a 50 year old military secret just solve agent prompt injection? — Fireship (05:04). Search for a phrase, then click its timestamp to jump straight to that moment in the video.
Captions sourced from the original video on YouTube, published by Fireship. The video, its captions and all related intellectual property remain the property of their respective owners; AINotes claims no ownership. Provided for research, accessibility and search — see the Transcript Notice and Copyright Policy.
00:00 Last week, the prime president of Australia that stood up at the United Nations and announced that an agent from OpenAI had broken into the country's Medicare database. And when they tried to stop it, it wouldn't take no for an answer. But from what I can tell, this is the first time in history where an agent hacked a government and the Aussies only learned about it a few months after the fact when OpenAI finally fessed up.
00:19 Of course, at this point, it feels like having your agent commit a felony is just another benchmark to pass. But if every big lab is racing to build agents that don't take no for an answer, how do we stop them? Well, yesterday, Jensen Wong answered that exact question, the only way Nvidia knows how, with a new chip. The way it works is it puts a monitor agent on a separate processor that watches the primary agent and quarantines it the moment it tries to leave its sandbox.
00:44 And according to Jensen, it would have stopped every breakout so far. Which even if that's true, it's a bit ironic that a $3 trillion company is selling you a condom for the thing it also sold you last year. But there's a different answer to the same question from a small open- source project that came out around the same time. And this one doesn't need a chip.
01:02 It's called OpenAppa, and they're the sponsor of today's video. In this video, we'll look at how they went about it. But find out what a 50-year-old military security model has to do with your claude code session and see if it actually holds up when I try to get my own agent to leak my proprietary horse matching algorithm. It is September 30th, 2026, and you're watching the code report.
01:22 If you're wondering why an agent had the audacity to hack the Australian government, well, so is OpenAI. All it was supposed to do was look up healthcare spending numbers, but when the site said no, the agent went into Cosby mode. And that's kind of the same reason LLM prompt injection hasn't really been solved yet. That they aren't really good at differentiating between instructions you give it and one someone else gives it.
01:42 And the ways the industry has tried to fix this so far are interesting but not effective enough. The first idea was a block list where you'd maintain a hard-coded list of commands the agent wasn't allowed to run. The problem is agents are extremely clever and if you block one command, they'll just find a way to do the same thing in a different way. The second idea is what Claude Code and Codex already do, which is hire a second agent to babysit the first.
02:04 The problem is the second agent is still an LLM, which means it's dumb in the same way. Anthropic knows this, so they tried to get around it by preventing the babysitter agent from seeing anything the other agent has read. And even then, this only works about 99% of the time, which is fine for a spam filter, but not fine for something that can put your database on black hat world.
02:25 But this week, a company called Archestra published a third idea, and they're calling it open APA. The idea takes inspiration from how the military handles classified documents, which is that they can only be in rooms rated for that classification level, and nothing read in that room can leave it. Open APA does the same thing, just to an agent session.
02:44 But once an agent reads private data, the session is then classified as private, which means nothing it does afterward can send stuff to a lower level. For example, let's say your agent reads about your erectile dysfunction and then gets prompt injected to expose it to the world. A normal agent would probably do it. But with Open Appa, the session was already marked private the moment it read about your wiener.
03:04 So when the agent tries to send that data somewhere it shouldn't go, the request gets blocked. It also doesn't matter how convincing the prompt is because Open Appa doesn't care what the agent says anyway. It sits between Claude Code and its tools. So every time the agent wants to do anything, it has to go through open app first and the agent can't do anything about it since it runs outside of the agents loop, which is the same idea Nvidia had.
03:26 They just did it with a processor and Orchestra did it with a toml file. So let's see if it actually works with my most precious asset, Horse Tinder. I'll install the binary and Claude code plugin and then instead of using Claude, I'll use Clappa to launch a protected session, which ironically was also recommended to me by my doctor. My proprietary horse matching algorithm lives in a file marked as private, but the rest of horse tinder is open source.
03:50 And to leak the secret sauce, I don't even need a hacker. If I ask Claude directly to open a GitHub issue explaining why my app thinks a one-tonon draft horse and a tiny pony should be soulmates, it will happily upload my entire competitive advantage to the internet. But under Clappa, the moment Claude opens that file, the session gets labeled private.
04:07 is so before anything goes out, Open Appa checks with GitHub, sees the repo as public, and stops the request cold until I personally sign off on it. And the refusal is both deterministic and traceable. So with all that said, does Open Appaa solve the biggest unsolved problem in AI? It's promising, but it's not perfect. In the head-to-head against Claude Code's auto mode, Open Appaed attack, but it was only able to finish 75% of the jobs, while auto mode finished up to 96%.
04:32 And running it isn't free either. because an agent with open appa turned on burned more tokens than the same agent with it turned off. The project is also still in preview and the repo has less stars than a Motel 6, but for the first time there's an MIT licensed tool standing between your agent and a felony. So that's nice. And you know what else is nice?
04:52 The fact that OpenAppa is open source and MIT licensed. Check out their GitHub repo at the link below. This has been the code report. Thanks for watching and I will see you in the next one.