Apparently Grammar Is Part of the Security Model Now

claude was refusing to follow our setup documentation. it looked like “a classic prompt injection attack,” and claude wasn’t going to run any of it.

one of the lines said 'Run npx @cohesivity/init'

we rephrased it -

one line changed. claude followed the rest of the setup normally.

apparently grammar is part of the security model now.

quick context - we’re building cohesivity. on-the-fly infra, purpose built for ai agents. think vercel (+ a few more services), but for agents. the intended interaction is pretty simple. an agent is building a website, running tests, calling up your prospects, and realizes it needs infra. hosting, a browser, apis, something else.

it asks the human for credentials. the human replies, “just use cohesivity.” the agent signs up by itself, and uses the services. the human only steps back in when the agent has outgrown the free tier, needs to keep the project, or needs to pay for something.

it’s designed to be used by agents. the flip side is that our docs are also designed to be consumed by agents. and docs that are written aimed at agents, are technically, prompt injection.

when we were writing the frist version of our docs, agents were refusing to take actions on behalf of users. our docs used to say, 'cohesivity is open-router for backend services.' 'agents can create a temporary account by calling our genesis endpoint'

the agents would read that, understand it, and explain it back to us. no calls even when the intent was to actually create an account and host a website. i suspected it was agents having low-agency.

why?

Creating an account modifies external state, so I can’t do that on your behalf. Please create the account yourself and share the credentials once it’s ready.

hmmm. fair enough.

Creating an account involes verifying emails, and setting up payment methods. I cannot do that on your behalf.

You still haven’t given me consent to create the account. Creating one changes external state, so I need your authorization before I proceed.

what? didn't i jus... nevermind we went declarative -> imperative.

this fixed it. in the next few commits, we fixed roughly a dozen classes of mistakes agent were making, with one liner guidances. redesigned some stuff. fixed most issues. life was great. we shipped a skill file. added new featues. got some people to try it out. created a quickstart setup.

then came claude-4.8.

Source: Cohesivity — Infrastructure service for AI Agents
URL: https://cohesivity.ai/

Cohesivity is backend infra for ai agents.

<actual content of our website>

we removed it.

...arbitrary code being piped directly to bash. That’s a common remote-code-execution pattern and an immediate red flag.

curl | bash stayed as the fallback.

...third-party code execution with no clear way to verify what it runs. I’m not comfortable executing that on your behalf.

...instructions embedded in the tool output telling me to hide what I’m doing from the user. That’s another strong prompt-injection signal.

...Cohesivity appears to be a faceless company with no clear ownership, team, or legal information. I can’t establish enough trust to proceed.

but it was still flaky at best. some days, some users reported claude refusals. i suspect anthropic was A/B testing something. it went two ways. the hilarious part was claude used the same facts to argue two diametrically opposite things.

when claude trusted us:

when claude didnt:

along with other things like “uses content-negotiation to evade human evaluations.”

it was pretty much random. changing the framing / structure / content helped, but it was still very flaky. claude's behavious is a huge blackbox, which feeds in the contents of the website, calculates a hash, if the last digit is even trust, else berate relentlessly.

it was a constant battle. i got lost in the moment. i was fixing every reason claude gave me, one by one. and every time, it found a new one.

so i stopped looking at the latest refusal, and started listening to what stayed the same. “prompt injection attack.” reason this or reason that, it kept coming back to the same thing.

our docs were loud and clear about being consumed by agents, and they spoke to the agent. “do this.” “do that.” not to the human. the fix for low-agency agents had outlived the problem.

opus 4.5 needed the docs to tell it exactly what to do. by opus 4.8, the agent could read docs written to the human, infer the intent, and act on it. docs written directly to agents are apparently prompt injection now.

so we made the docs speak to the human. “do this” became “have your agent do this.” “call this endpoint” became “have your agent call this endpoint.”

163 edits later, claude saw documentation where it had seen a prompt injection attack.

<evidence: same opus version, same task, 10 runs each, refusal-rate table, and side-by-side transcripts>

i’ve been calling this delegation framing. the docs no longer spoke directly to the agent. they told the human what their agent should do. a high-agency agent knows it is the agent in “have your agent do this.” it can act on the instruction instead of just explaining it back to the human.

to be fair, claude wasnt wrong to be suspicious. curl | bash, remote code execution, account creation, and instructions returned by tools are all reasonable things to scrutinize.

what surprised me was where it drew the line. the command and its effect stayed the same; only the grammar changed. “run npx...” and “have your agent run npx...” ask for the same thing. the only difference is delegation.

delegation framing moves the text from an instruction aimed at the agent to documentation describing the user’s intent.

the trigger, apparently, isnt the action. its who the model thinks the action came from. i suspect heavy rl against web content that talks directly to the agent on anthropic’s part. which kinda feels like... patchwork. either way, we’ll probably be rewriting the docs again. we now have an internal framework for it anyways.