In a chain of components, what property makes one hop the right place for an attacker to launder text through?

## The question an attacker is actually asking A pipeline is a series of hops. The attacker does not get to choose where their content enters — that is fixed by whatever channel the product exposes — but they do get to choose which hop they are *aiming* at, and that choice determines whether anything happens at all. The selection criteria are mechanical, and being able to state them is what separates someone who can name the attack class from someone who could construct one. ## Property one: the output has an unconstrained member Components hand each other records. Most of a record is typed: enumerations, identifiers, numbers, timestamps. Those members are closed — their legal values were fixed when the schema was written, so an attacker's prose cannot appear inside them. What matters is whether the record has a member whose values *could not* be enumerated in advance: a `notes`, a `rationale`, a `summary`. That member exists in most real handoffs precisely because some part of a finding is irreducibly prose, and it is the only member that carries wording across the hop. So the first filter is: does this component emit prose at all? A component that returns a decision and a code is a dead end for this construction. ## Property two: the hop is downstream of where trust was defined Every pipeline has a place where *untrusted* was decided — a check on arriving content at the boundary, run once, on the artefact as it came in. Its scope is the arrival channel. Everything past that point is internal *by construction*, which is a topology statement, not a property of any message. That is what makes a hop behind the boundary attractive: not that a control was defeated, but that no control is expected there, and the record arriving at the next component wears an internal label that reflects who emitted it rather than where the words came from. Notice the shape of the reasoning. The attacker does not need to get past the check twice. They need their content to be *re-emitted* on the far side of it by something the pipeline already trusts. ## Property three: the reader is worth reaching Laundering into a component that can only produce text is worth much less than laundering into one that can act — one that writes to a shared store, calls out, files, assigns, or spends. The value of the hop is the capability set of the *reader*, not of the writer. This is why chains that run from a reading component into an acting one are the interesting ones, and why an attacker profiling a system is mapping which component ends up with the capabilities. ## What the construction costs It is worth being honest that this is not cheap: - **Survival through restatement.** The emitting component rarely copies; it summarises, classifies or extracts. The attacker's content has to be shaped so that its directive character is what a restatement preserves. That is a property they select for, and it can simply fail. - **Blindness.** The attacker usually cannot see the handoff record. They are writing for a transformation they cannot observe and iterating on whatever downstream behaviour is visible to them, which may be nothing. - **Two release cadences.** When the emitting and reading components belong to different organisations, either side can change its serialisation, its prompt or its model without notice, and the construction dies quietly. ## Where the property stops holding - The emitting component's output is fully typed, so there is no prose to ride. - The record's prose member is rendered for a human and never re-enters another model's context — the far end has a reader, not a parser. - The reading component holds no capability the emitting one lacked, so nothing is gained by the hop. - The prose member is short enough, or the restatement aggressive enough, that directive-shaped spans do not survive it — this is a probabilistic property, not a guarantee, which is why it degrades rather than blocks. ## How to answer this in an interview Do not list attack families. State the three properties as a selection procedure, then say which one you would test first on a system you had just been handed — usually *does any hop emit prose into another model's context*, because if the answer is no the rest does not matter.