Reverse Prompt Injection doesn't come from the internet: it lives in your own folders

We all look for Reverse Prompt Injection outside. We assume the attack vector lives on a malicious website, inside a downloaded PDF, or through a third-party API.

I found it inside. On my own drive, while building the demo video for WAIO (Web AI Orchestrator).

If you are not familiar with it, WAIO is a local engine that gives hands to web AIs: the AI generates a structured JSON, WAIO detects it in the downloads folder, and executes it locally (no APIs, no tokens).

During my tests, I discovered something both fascinating and alarming: the environment turns into a prompt.

For the demo video, I needed to generate a PPS-style HTML file (an automatic image slideshow) without having to write 20 lines of CSS by hand.

I decided to run an experiment using Passive Context Architecture:

Take a look at the names of some of those harmless text files:

The standard operating flow of the test went as follows:

It generated an impeccable HTML code containing precisely:

None of that was in my user prompt or in the Master Prompt.

The AI ignored the source of truth (my simple instruction) and obeyed the environment metadata. The names of the text files and images acted as a passive instruction injection.

I repeated this test across various different folders and the result happened consistently.

Most autonomous agents and AIs with local tools operate with global and fixed directories, or lack a controlled permanent workdir.

Imagine an agent with access to system folders where you ask it to "organize my files." An attacker (or a third-party script) can deposit files with instructional names in that path.

This is where the architecture of WAIO marks a fundamental design difference: WAIO does not have a permanent or global workdir.

It operates solely within the specific folder that the user chooses to bound via an explicit sandbox for that session. If there is no control over that specific working folder, the environmental injection vector is neutralized.

Everything described in this report can be seen in action in the WAIO presentation video available in the official documentation. The audiovisual material clearly shows the exact instructions given to the AI, the outcome obtained, and the actual contents of the folder displaying the.txt files with their instructional names.

🔗 You can check the complete documentation, logs, and video on the Official WAIO Website.