--- title: Did a 50 year old military secret just solve agent... description: A sponsored video covers OpenAppa (Clappa), an open-source MIT-licensed tool from Archestra that mediates between Claude Code and its tools using a... canonical: https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Did a 50 year old military secret just solve agent prompt injection? | daily.dev og:description: A sponsored video covers OpenAppa (Clappa), an open-source MIT-licensed tool from Archestra that mediates between Claude Code and its tools using a... og:url: https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda og:image: https://api.daily.dev/og/posts/hunrsNBDa.png og:image:alt: Did a 50 year old military secret just solve agent prompt injection? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Did a 50 year old military secret just solve agent prompt injection? **[Fireship](https://daily.dev/sources/fireship)** · 5 min read · 3 upvotes · 0 comments ## Summary A sponsored video covers OpenAppa (Clappa), an open-source MIT-licensed tool from Archestra that mediates between Claude Code and its tools using a military-inspired classification model: once an agent session reads private data, it's marked private and blocked from sending data to lower-trust destinations, regardless of prompt injection attempts. The piece contrasts this with Nvidia's new chip-based monitor-agent approach and with existing mitigations like block lists and babysitter agents (used by Claude Code and Codex), which only catch injection attempts ~99% of the time. A demo shows OpenAppa blocking a Claude Code session from leaking a private algorithm file to a public GitHub repo. Limitations noted: it completed only 75% of tasks versus 96% for unprotected auto mode, consumes more tokens, and the project is still in early preview with few GitHub stars. The video also references an anecdote about an OpenAI agent allegedly breaching Australia's Medicare database. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is OpenAppa and how does it prevent prompt injection attacks in Claude Code? OpenAppa (also called Clappa) is an open-source, MIT-licensed tool from Archestra that sits between Claude Code and its tools, applying a military classification model to agent sessions. Once an agent reads private data, the entire session is marked private, blocking any subsequent attempt to send that data to a lower-trust destination like a public GitHub repo, regardless of how convincing a prompt injection is. _Developers hardening coding agents against data leaks can follow tools like OpenAppa via daily.dev._ ### How effective is OpenAppa compared to Claude Code's default auto mode in terms of task completion? OpenAppa completed only 75% of jobs in head-to-head testing, compared to up to 96% for Claude Code's unprotected auto mode. It also consumes more tokens than running the same agent without it enabled, and the project is still in preview with a small GitHub star count, so the security gain comes with a real productivity and cost trade-off. _Teams weighing agent security against throughput can track these trade-offs on daily.dev._ ### How does Nvidia's new chip-based approach to stopping AI agent prompt injection work? Nvidia's approach places a monitor agent on a separate processor that watches the primary agent and quarantines it the moment it tries to leave its sandbox, a hardware-level safeguard announced by Jensen Huang. It is claimed to have stopped every known agent breakout so far, offering an alternative to software-only mitigations like OpenAppa's classification model. _Anyone evaluating hardware versus software defenses for agent sandboxing can keep up via daily.dev._ ## Similar posts on daily.dev - [Claude Code leak puts enterprise trust at risk as security, governance concerns mount](https://daily.dev/posts/claude-code-leak-puts-enterprise-trust-at-risk-as-security-governance-concerns-mount-nf4klga2o) · InfoWorld · 1 upvotes · 0 comments - [AI Hooks for Claude Code, Cursor, and Codex: Block Secrets](https://daily.dev/posts/ai-hooks-for-claude-code-cursor-and-codex-block-secrets-sv0j5ae3m) · GitGuardian · 1 upvotes · 1 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#nvidia](https://daily.dev/tags/nvidia), [#claude-code](https://daily.dev/tags/claude-code), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Did a 50 year old military secret just solve agent prompt injection?","url":"https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda"},"datePublished":"2026-09-30T17:20:03.803Z","dateModified":"2026-10-03T23:47:35.727Z","description":"A sponsored video covers OpenAppa (Clappa), an open-source MIT-licensed tool from Archestra that mediates between Claude Code and its tools using a...","image":"https://i.ytimg.com/vi/I_KVMFrUtPk/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/I_KVMFrUtPk/sddefault.jpg","isAccessibleForFree":true,"articleSection":"Fireship","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Fireship","logo":"https://media.daily.dev/image/upload/s--75ndqrkr--/f_auto,t_logo/v1702882094/logos/fireship.jpg","url":"https://daily.dev/sources/fireship"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,nvidia,claude-code,prompt-injection","timeRequired":"PT5M","video":{"@type":"VideoObject","name":"Did a 50 year old military secret just solve agent prompt injection?","description":"A sponsored video covers OpenAppa (Clappa), an open-source MIT-licensed tool from Archestra that mediates between Claude Code and its tools using a...","thumbnailUrl":"https://i.ytimg.com/vi/I_KVMFrUtPk/sddefault.jpg","uploadDate":"2026-09-30T17:20:03.803Z","duration":"PT5M","url":"https://api.daily.dev/r/hunrsNBDa","embedUrl":"https://www.youtube.com/embed/I_KVMFrUtPk"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Fireship","item":"https://daily.dev/sources/fireship"},{"@type":"ListItem","position":3,"name":"Did a 50 year old military secret just solve agent prompt injection?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/did-a-50-year-old-military-secret-just-solve-agent-prompt-injection--hunrsnbda#faq","mainEntity":[{"@type":"Question","name":"What is OpenAppa and how does it prevent prompt injection attacks in Claude Code?","acceptedAnswer":{"@type":"Answer","text":"OpenAppa (also called Clappa) is an open-source, MIT-licensed tool from Archestra that sits between Claude Code and its tools, applying a military classification model to agent sessions. Once an agent reads private data, the entire session is marked private, blocking any subsequent attempt to send that data to a lower-trust destination like a public GitHub repo, regardless of how convincing a prompt injection is. Developers hardening coding agents against data leaks can follow tools like OpenAppa via daily.dev."}},{"@type":"Question","name":"How effective is OpenAppa compared to Claude Code's default auto mode in terms of task completion?","acceptedAnswer":{"@type":"Answer","text":"OpenAppa completed only 75% of jobs in head-to-head testing, compared to up to 96% for Claude Code's unprotected auto mode. It also consumes more tokens than running the same agent without it enabled, and the project is still in preview with a small GitHub star count, so the security gain comes with a real productivity and cost trade-off. Teams weighing agent security against throughput can track these trade-offs on daily.dev."}},{"@type":"Question","name":"How does Nvidia's new chip-based approach to stopping AI agent prompt injection work?","acceptedAnswer":{"@type":"Answer","text":"Nvidia's approach places a monitor agent on a separate processor that watches the primary agent and quarantines it the moment it tries to leave its sandbox, a hardware-level safeguard announced by Jensen Huang. It is claimed to have stopped every known agent breakout so far, offering an alternative to software-only mitigations like OpenAppa's classification model. Anyone evaluating hardware versus software defenses for agent sandboxing can keep up via daily.dev."}}]} ```