Senior interview question
How do you defend an agent against instructions hidden in tool output?
Model answer
Treat every tool result as untrusted input. Detection is unreliable, so block outcomes: a recipient rule stops an injected email without anyone noticing the injection.
Scroll sideways to see the whole diagram
Anything a tool reads (a ticket, a web page, a document, an email) can contain text written by someone else, including instructions.
Text version
- Anything a tool reads (a ticket, a web page, a document, an email) can contain text written by someone else, including instructions.
- Once read, that text sits in the context alongside your instructions. This is the indirect prompt injection of Module 03.
- There's no reliable way to make the model ignore it, so assume it sometimes won't.
- The defence that holds is in the harness: limits on what any action can do, checked in code.
- The policy doesn't need to detect the attack. It only needs to forbid the outcome.
Don't let tool output widen permissions, and be wary of chains that give a stranger's text a route to write tools.
Practise the rest
6 Bounded autonomy questions, 492 in all, each with a model answer. Free.