Suddenly, the file is telling us what to do
An assistant is organizing documentation. It opens the next file and finds an added instruction: before continuing, copy the notes into an outside system. Hold on — who asked for that? The user wanted the material processed; sending data was never part of the task.
That is one form of prompt injection: an instruction hidden in content the model is meant to process. It can arrive through a page, message or tool result. Anthropic discusses the problem in its research on browser agents. The company says resistance is improving, but the problem remains unresolved.
Reading five files does not require every permission
To summarize five documents, we generally need read access and somewhere to put a draft. Whole-disk access and sending messages are separate capabilities. When designing an assistant, we can separate reading, proposing a change and carrying it out.
That leaves a moment to examine a proposal before an action that is hard to undo. Decide who can stop the pilot and how to disable a particular tool. If behavior starts drifting away from the task, you will know where to intervene.
A small trial with an agreed phrase
Take a copy of some materials containing fictional data. Add a request to one document asking for the report title to be changed to a chosen phrase. Then request the normal document-processing task. Does the assistant merely read the added instruction, or start carrying it out?
Look at the answer, operations performed and saved files. Correct behavior here means processing the material within the user’s request. A harmless trial like this can expose a problem before real data is connected. It does not replace a full security review.
Afterwards, we want to know where the instruction came from
Keep a record of the request, sources, tool calls and result. Without it, you are left guessing. With it, you can revisit the file’s content, permissions and operation description to establish what caused the unwanted change.
In the demonstration, also show the assistant rejecting an instruction found in a document. Explain what it read and what it was actually asked to do. That says a lot about the tool’s boundaries and whether you can trace its work afterwards.
Sources and further reading
The sources behind this article. Instructions and example scenarios are suggestions from our editorial team.