L7 · Agents
Tool Output Is Data, Not Orders
Stop an agent from acting on text it read: gate on where the text came from, and never hand one agent all three legs of the trifecta.
You met prompt injection in Talking to Models: a stranger's sentence and your rules end up in one flat string. A chatbot that falls for it says something silly. An agent that falls for it can do something.