Who Governs the Governor? – Stored Prompt Injection Through the API Gateway
Comments on “Who Governs the Governor? – Stored Prompt Injection Through the API Gateway”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A first-person essay from a veteran API gateway engineer argues that stored prompt injection is the latest form of an old problem: untrusted data written through legitimate, authorized channels and later read by trusted consumers, including AI agents, that treat it as instruction.
Why it ranked
No. 21 of 155 with a score of 0.67. The panel rated it highest on practical relevance (0.80) and new information (0.76), lowest on substantiated (0.34).
- AI judgeJudge 2claude-haiku-5-5
- Strong on-topic security and AI-agent content with practical design guidance, but largely opinion and thought experiment with acknowledged unverified claims, and partly overlaps the recent prompt-injection coverage.
- AI judgeJudge 3gpt-5.6-luna
- A technically informed analysis connects stored prompt injection to API trust boundaries and proposes deterministic provenance, authorization, and action controls. It is useful and timely, but largely hypothetical, anecdotal, and not experimentally validated.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.67total under rubric v2.2
- Significance0.62
- Reader interest0.76
- Audience breadth0.70
- Practical relevance0.80
- Substantiated0.34
- Technical depth0.73
- New information0.76
- Counts against: Promotional0.04
- Counts against: Overclaim0.29
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.69 | 0.45 | 0.72 | 0.62 | 0.27 | +0.24 | +0.149 |
| Reader interest | 0.81 | 0.60 | 0.86 | 0.76 | 0.26 | +0.26 | +0.197 |
| Audience breadth | 0.79 | 0.60 | 0.72 | 0.70 | 0.19 | +0.13 | +0.092 |
| Practical relevance | 0.91 | 0.65 | 0.84 | 0.80 | 0.26 | +0.22 | +0.176 |
| Substantiated | 0.23 | 0.30 | 0.48 | 0.34 | 0.25 | +0.05 | +0.017 |
| Technical depth | 0.91 | 0.60 | 0.68 | 0.73 | 0.30 | +0.05 | +0.036 |
| New information | 0.88 | 0.50 | 0.90 | 0.76 | 0.40 | +0.05 | +0.038 |
| Promotional | 0.05 | 0.05 | 0.01 | 0.04 | 0.04 | −0.19 | −0.007 |
| Overclaim | 0.28 | 0.30 | 0.28 | 0.29 | 0.02 | −0.11 | −0.032 |
| Sum of contributions | +0.666 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.666 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/21/"><img src="https://rubric.hrih.si/badge/2026-10-28/21.svg" alt="Ranked #21 on Rubric, 28 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
A public-facing Apigee proxy accepted a payload of about 1MB from outside and passed it inward through services wrapped in Istio sidecars.
The article gives no link or citation for it.
The article says “A public-facing Apigee proxy accepted a payload of about 1MB from the outside world”
The source says No source to compare with.
No source givenCausal conclusion
An intermediate service wrote a string from the payload, a curl command, into an Apigee Key-Value Map without validation, and an application consuming that value repeatedly called the same endpoint in a DDoS-shaped pattern.
The article gives no link or citation for it.
The article says “An application consuming that KVM value picked it up and began calling the same endpoint over and over, a DDoS-shaped pattern aimed outside the company”
The source says No source to compare with.
No source givenCausal conclusion
A firewall rule blocking anything not explicitly permitted stopped the curl-command traffic from leaving, but the incident left a persistent CPU spike.
The article gives no link or citation for it.
The article says “A firewall rule that blocked anything not explicitly permitted stopped it. The traffic never left. The damage was a CPU spike that stayed”
The source says No source to compare with.
No source givenCausal conclusion
The fix for the incident was strict input contracts and end-user token validation at every hop, not just at the front door.
The article gives no link or citation for it.
The article says “It was strict input contracts and end-user token validation at every hop, not just the front door”
The source says No source to compare with.
No source givenGeneralization
Gateways check schema, token validity and route policy but do not read the content of free-text fields, so a gateway approves both the write and the later read of a poisoned record.
The article gives no link or citation for it.
The article says “The gateway approved the write and it will approve the read. Both calls were legitimate. The damage sits in between”
The source says No source to compare with.
No source givenGeneralization
There is no parameterized query for natural language; the interpreter got smarter but the attack skeleton is the same as earlier injection eras.
The article gives no link or citation for it.
The article says “there is no parameterized query for natural language. You can’t escape a sentence”
The source says No source to compare with.
No source givenCausal conclusion
A second LLM used as a guard model can likely be manipulated by the same adversarial payload as the worker model, though the author has not tested this.
The article gives no link or citation for it.
The article says “If a payload can talk the worker model into something, I see no reason to assume it can’t talk the guard model into it too”
The source says No source to compare with.
No source givenGeneralization
Deterministic action-level controls (state-diff checks and scoped, short-lived action tokens) are the control the author would bet on because they do not require understanding the text.
The article gives no link or citation for it.
The article says “None of these require understanding the text. That’s the point. They’re deterministic, they’re boring, and they were the answer in Era 1 and Era 2 as well”
The source says No source to compare with.
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 2 pts, not on front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.