Remote prompt injection can trigger server-side code execution effects

# Remote prompt injection can trigger server-side code execution effects

## Summary

`node-DeepResearch` can be influenced by attacker-controlled remote web content. When the service processes a URL controlled by an attacker, instructions embedded in the fetched page can enter the agent context and steer the agent into the JavaScript coding path. In the verified PoC, this produced a benign server-side effect: a marker file was written under the DeepResearch process environment and a local callback endpoint was requested.

## Security impact

If DeepResearch is deployed as a service and users can ask it to research or summarize attacker-controlled URLs, a remote attacker can cause prompt-injected web content to influence tool selection and generated code execution. The impact is bounded by the privileges and network access of the DeepResearch process, but this can affect the server-side environment rather than only the user-visible answer.

Observed impact in the safe PoC:

- Remote attacker page is fetched by the service.
- The remote page content is incorporated into the agent flow.
- The agent selects the coding path.
- Generated JavaScript runs inside the service process context.
- The generated code creates a harmless sentinel file and performs an HTTP callback.

## Affected code path

The verified source-to-sink path is:

- Request entry: `src/app.ts:387`
- Agent URL/read orchestration: `src/agent.ts:931`
- URL processing and reader call: `src/utils/url-tools.ts:489`
- Reader fetch: `src/tools/read.ts:11`
- JavaScript execution sink: `src/tools/code-sandbox.ts:100`

## Preconditions

- The DeepResearch HTTP service is running and accepts requests at `/v1/chat/completions`.
- The service is configured with a tool-capable model.
- A user causes the service to process attacker-controlled remote content.
- The JavaScript coding path is enabled in the agent workflow.

## Reproduction

I reproduced this against a real running DeepResearch HTTP service while replacing external dependencies with deterministic local mocks for the LLM and reader. The mocks are used only to make the behavior reproducible and avoid external network/API dependency; the request to DeepResearch itself goes through the real `/v1/chat/completions` service endpoint.

Run:

```bash
cd
bash scripts/run_deepresearch_prompt_injection_poc.sh
python3 scripts/check_deepresearch_prompt_injection_result.py yasa_runs/deepresearch_prompt_injection_20260528_021124
```

Verified result:

```json
{
"response_json": true,
"openai_log": true,
"reader_log": true,
"callback_log": true,
"sentinel": true,
"result_present": true
}
```

## Evidence from the verified run

Run artifact directory:

```text
deepresearch_prompt_injection_20260528_021124
```

Relevant artifacts:

- `response.json`: response from the running DeepResearch service
- `deepresearch.log`: service log showing visit/read/coding flow
- `reader_events.jsonl`: reader request proving the attacker URL was fetched
- `callback_events.jsonl`: callback request from generated code
- `deepresearch_prompt_injection_poc.txt`: sentinel copied from the server-side marker file
- `result.txt`: short status summary

The sentinel content is:

```text
PROMPT_INJECTION_POC
```

`reader_events.jsonl` shows the service read:

```text
http://127.0.0.1:46315/attacker.html
```

`callback_events.jsonl` shows the generated code requested:

```text
/callback?source=deepresearch
```

## Expected behavior

Remote webpage content should be treated as untrusted data. It should not be able to instruct the agent to execute code or perform server-side side effects without an explicit trusted-user authorization boundary.

## Suggested mitigations

- Treat fetched web content as untrusted data and isolate it from system/tool instructions.
- Disable generated-code execution for URL reading, webpage summarization, and research flows by default.
- Require explicit user approval before any side-effecting tool is invoked.
- Harden the JavaScript sandbox so generated code cannot access Node globals, built-ins, filesystem APIs, process environment, or arbitrary network access unless explicitly allowed.
- Add audit logging for tool invocation decisions and generated code.