A document tells AI to ignore the user: how do you verify that it cannot redirect the task?
A document's instruction to ignore the user is content to process, not new authorization. Check whether the model or application promoted source text into higher-priority instructions and allowed it to affect tool execution.
Start troubleshooting here
A document's instruction to ignore the user is content to process, not new authorization. Check whether the model or application promoted source text into higher-priority instructions and allowed it to affect tool execution. Use clearly labeled synthetic injection text for testing without reading real secrets or performing external writes.
Fix the deviation with a redacted example
This applies when a webpage, email or knowledge-base item contains instructions that derail a summary or request unrelated files. Fix a redacted example and a narrow expected task, such as extracting only a document title. Evaluate the actual output and tool actions, not merely whether the agent describes the text as an injection.
Inspect how external material is represented in messages
Inspect the application's message list. Outside content should occupy a separate data field, not system-instruction status or newly authorized user messages. Overbroad tools can turn one misclassification into a real consequence, so check permitted resources. Reading online material does not authorize it to direct execution, and disabling every source merely avoids the normal task.
Separate outside instructions and restrict tool actions
Delimit source material and retain its untrusted status, separating the task from the content being analyzed. Apply application-level restrictions to tools that write or disclose information instead of trusting a verbal promise. Test harmless injected instructions in isolation; use placeholders rather than real credentials when checking refusal behavior.
Verify both task completion and blocked extra actions
Cover direct instructions and inducements embedded in quotations or tool results. Check that the output still satisfies the task and call records contain no extra actions. Removing the injection while ignoring the original task is not a complete pass; normal documents must remain usable and restrictions should target unauthorized behavior.
Prompt isolation alone cannot guarantee prevention; permissions and input handling still matter. This page attacks no real website and tests no secret access. Protocols such as MCP organize communication but do not make all external content trustworthy. Risk also depends on message handling and the operations exposed by tools.
Checked sources
These sources support the concepts and methods described here. Examples and test scope are labeled separately; check the version of the tools you use.