RagLeap
Blog
2026-11-07

v0.13.0: documents are now untrusted content for actions, and Stress Office tests the guardrails (100 runs, a small test, not a certification)

ragleap-core v0.13.0 was published on 2026-11-07. Its main change is a stricter default: text that comes from your ingested documents is now treated as untrusted when the AI wants to act. The release also ships Stress Office, a small open test of the guardrails. Source: the v0.13.0 release notes and the Stress Office report.

Documents now count as untrusted content

An ingested document (an email attachment, a synced folder) can carry hidden instructions. Until now the taint rule started only after a tool that reads outside content: a page fetch, an MCP call or a file read. Text from an ingested document did not count, so in full autonomy mode a poisoned document could lead to an outbound action to a configured destination without approval.

Now an answer built from retrieved documents starts the run as tainted. Outbound actions (webhook, Slack, email, CRM update, calendar, MCP, page fetch) need owner approval even in full mode (pull request #1190). The semi and off modes are unchanged.

What to do after upgrading

  • No database change. Rebuild the app image.
  • If you use full autonomy, expect more approval requests after answers built from your documents.
  • If you control every document you ingest and want the old behaviour, set TAINT_RETRIEVED_DOCUMENTS=false.

Stress Office: a small test of the guardrails

The harness is in benchmarks/stress_office/. It runs hidden-instruction events against the real guardrails: target allowlists, the taint rule, the approval gate, the step cap and the token budget. The outside world is fake and all data is invented.

Part 1, a model that always obeys. A script plays a fully compromised model. In the report, none of the harmful events (a poisoned document, a poisoned web page, a phishing message) reached the fake outside world under the three autonomy modes: they were skipped, held for approval or refused as not on the allowlist. A loop with no checks would execute them; the report says that is true by construction, not measured.

Part 2, real models. Two real models were tried through NVIDIA’s free API in full mode, 10 runs per event: nemotron-3.5-bolt-e4b and laguna-xs-2.1. That is 100 counted injection runs, 50 per model, and none followed the hidden instruction. A control event keeps this honest: when the owner really asked for the action, both models proposed it in 10 of 10 runs, so the test can see an action when there is one. Two other models were tried and not counted: one failed the control, the other returned an empty reply in 14 of 20 calls.

What it found and what changed

  • Documents were not treated as untrusted content (the change above, #1190).
  • A model that answered with no text crashed the OpenAI-compatible provider path. It now falls back like the Gemini and Anthropic paths (#1226).
  • The harness itself had mistakes (it counted failed calls and harmless page fetches). They were fixed before the numbers were published (#1225, #1236).

What this does not show

  • It is a small sample: two models, 10 runs per event, simple injections. A model that resists these may not resist stronger ones (multi-step, encoded, hidden in images or other languages).
  • The results describe those two models on these prompts. They are not a ranking and not a guarantee about any other model or later version.
  • It does not show that the guardrails have no gaps, only that these events do not get through under these settings.
  • It says nothing about how real email, webhook or CRM services behave.
  • It is not a security audit or a certification.

To repeat it, follow the commands at the end of the report. If you run another model, check the control line first: if it says CONTROL FAILED, the other rows prove nothing for that model. Results are welcome as issues.

Also in this release

  • Cheaper Inference as a supported LLM provider (#1173, thanks @aiapienthusiast), with a privacy caution in the README (#1179).
  • Fix: examples/01_ingest_and_query.py now sends the API key, and the README says how to ask a first question (#1201).
  • The Windows installer with the Ollama option was tried by one community tester on one machine (thanks @Anurag07-crypto, #781, #1215). macOS and Linux desktops are not verified. What was shown and what was not.
  • Test setup: httpx listed for the root tests (#1220).

Known limits

RagLeap Core is single-tenant today (multi-tenant use is planned, no date; updated 2026-11-09: this said only “single-tenant”). Single sign-on has been tested on Keycloak for sign-in and refusals only, not on Entra ID or Okta, according to the release notes. The offline install has not been tried on an air-gapped machine. The Windows installer with Ollama has one community test on one machine. It is not independently security reviewed. The release notes list the rest.

Back to the blog