PromptQL: Your Company Brain Will Leak Secrets

PromptQL co-founder Tanmai Gopal says a working company brain will leak secrets by default, and he demoed a fix built for banks. In an AI Engineer talk he showed a 5,000-page internal wiki that grows daily because people keep teaching a useful agent more.

The affected systems aren't databases. They're coding agents used as general workers: Claude Code, OpenClaw, Hermes and Claude Tag.

The attacker needs no exploit. Any logged-in teammate who asks the agent to handle a security questionnaire or debug an incident can pull another team's private context.

Gopal plotted their wiki edits and found daily updates climb, not plateau. People add a querying skill, then interpretation, then actions, then AB tests, so a healthy brain just gets noisier with use.

How the leak actually works

The leak is a permissions problem dressed up as memory.

Teams try two patterns today, and both fail. One is a shared GitHub skills repo nobody updates after day two. The other is a team brain, a Hermes bot that auto-saves memory into a channel silo.

Move that siloed memory to Slack and you get Claude Tag style per-channel recall. Useful in that channel, invisible elsewhere, and still auto-written.

PromptQL frames it as one giant folder of markdown files that link to each other. If every file is readable by every agent, your intern's agent can read finance comp the way a new hire could open the wrong shared drive.

The demo was concrete. A teammate answered a security questionnaire once, the agent captured the trust center and gateway details, then another employee asked the agent to draft a reply to StitchFix and it pasted the prior team's answers without a check.

What PromptQL's wiki model fixes, and what it doesn't

PromptQL enforces four rules. Keep one company-wide wiki, require every change to be suggested by the agent and approved by a named human, scope each file for who can read or write it, and never store credentials in the sandbox.

Reads use the requester's claims, so a finance wiki only opens if you have the finance claim. Tool execution is proxied the same way at the HTTP and SQL layer, so the agent acts as you, not as a superuser.

In multiplayer incidents the separation matters more. Gopal showed a live case where two engineers argued over an OpenTelemetry span name and a page name prefix that broke lookups in prod. The debate produced the best documentation, but a shared agent that can debug, open a PR, deploy to staging and prod with one identity would violate bank separation of duties.

His fix virtualizes every data touch. The user who configures a tool controls who gets access, and the agent borrows that user's credential just for that call.

The gap is human. Scopes only work if the approver picks the right file and scope. Tag a sensitive finance page as general and the leak returns, now with an audit trail showing who approved it.

For builders the takeaway is narrow. Don't let agents auto-write to shared memory, and don't co-mingle credentials in the sandbox.

Gopal's team, Hasura GraphQL veterans now building PromptQL after deployments at Apple, Meta and JP Morgan, has tested this with only 15 to 20 design partners. It hasn't been proven at Claude Tag scale.