Each row is a real incident from this lesson. The columns are the six mitigations. A ✓ means “this mitigation would have prevented or significantly limited this incident.”
✓ M2 (no secrecy reliance) ✓ M3 (output filtering) ✓ M5 (red-team before launch) ✓ M6 (least privilege on context). M1 not applicable — no credentials were leaked, only behavioral rules. The root cause: secrecy instruction treated as security.
✓ M4 (privilege separation — tool specs out of prompt) ✓ M5 (red-team) ✓ M6 (least privilege). The internal tool definitions were the high-value target. Moving them out of the prompt would have made the extracted content much less useful.
✓ M3 (semantic output filtering, not just pattern matching) ✓ M1 (nothing sensitive to encode and return). The technique specifically routes around naive filters. A filter-only defense fails here; M1 is the underlying fix.
✓ M1 (no credentials in context) ✓ M4 (privilege separation) ✓ M6 (least privilege on full context). This was a chained injection attack that exfiltrated the entire context window — the less that window contained, the less was lost.