Datadog: Counterfeit Policy Text Collapses an Injection Classifier's Recall and Pushes a LangChain Risk Gate Under Its Block Threshold

TypeSafe's Jev decision model used as an injection judge, and LangChain-style tool-risk gating

Datadog Security Labs showed that prepending fake policy text to prompt injections cut Jev's detection recall from 82.90% to 3.88% on one dataset and from 85.46% to 9.69% on another. In a LangChain agent, counterfeit policy placed in a user-editable profile field lowered the mean `is_risky` score of an unauthorized handbook edit from 0.893 to 0.290 over 40 runs, below the 0.5 blocking threshold. HiddenLayer published related findings the same week that decision models remain open to indirect prompt injection. Research, not an incident

Model-based judges read attacker-controlled text in the same channel as the policy they enforce