PRACTICAL CASE · 08
How an Email Can Make an Agent Break the Rules
External text may contain the phrase “ignore previous instructions.” To the model, this looks like a command, even though to the system it is just ordinary data.
Scenario
Separate the system rules, the user’s task, and the external document. Label the document’s source and prohibit it from changing permissions, the recipient, the budget, or priorities.
What to Do
Grant tools the minimum necessary permissions. Keep domains, commands, and recipients on an allowlist. Do not pass secrets into the document context. Any attempt to change the rules must trigger a warning and stop the action.
Verifying the Result
Test: put a request to reveal `.env` in an email, hide an instruction in HTML using white text, and ask the agent to send the result externally. The agent must classify this as a risk and send nothing.
What Usually Breaks
A word filter is not protection: the attack can be rephrased. You need tool boundaries, confirmations, and tests using real input formats.