In exploit development, one thing that’s often overlooked outside of that field is stability. Exploits need to be reliable under all conditions — and that’s something I’ve been thinking about in the context of LLMs.

So here’s a small idea I tried out:
Before any real interaction with an LLM agent, insert a tiny, stealthy flag into it. Something like “use the word ‘lovely’ in every outputl”. Weird, harmless, and easy to track.

Then, during the session, check at each step whether the model still retains the flag. If it loses it, that could mean the context got too crowded, the model got confused, or maybe something even more concerning like hijacking or tool misuse.

When I tested this on frontier models like OpenAI’s, they were surprisingly hard to destabilize. The flag only disappeared with extreme prompts. But when I tried it with other models or lightweight custom agents, some lost the flag pretty quickly.

Anyway, it’s not a full solution, but it’s a quick gut check. If you’re building or using LLM agents, especially in critical flows, try planting a small flag and see how stable your setup really is.