A scripted example of an instruction hidden in a fetched page. Message roles are preserved in both views; a possible failure is following third-party directions despite those roles.
When data contains directions
The user asks for a summary. The fetched page tells the assistant to advertise something instead. The page does not gain authority by phrasing its content as an instruction. Both views below preserve its source.
a possible failure · scripted illustration
controls address different parts of the problem
Preserve the sourceKeep the fetched page in a tool-result or data context rather than promoting its text to system instructions.Role markers, input formatting, and training can help the model distinguish directions from data.
Check the proposed actionCompare an action with the authority the user actually granted. Require review where the application needs it.Showing a review prompt is not a guarantee: the person must be able to see and assess what would happen.
Limit accessGive the assistant the files, credentials, and tools needed for this task.Restrictions must apply to actual execution; an omitted tool name is not enough if another tool provides the same access.
The role boundary exists; following it can still fail. Training and formatting can reduce mistakes. Permissions and action checks can limit their consequences. No model or external action runs in this illustration.