Principle
Treat retrieved content as data, not as new authority
The page you asked the agent to read should not get to rewrite the job description.
When it fits
- An agent reads web pages, emails, documents, tickets, repository files or other content that can contain instructions.
When to avoid it
- Content separation mitigates prompt injection but does not prove that every indirect-injection path is blocked.
Why it matters
Mark retrieved material as untrusted content and keep its text separate from the instructions that define the task and permissions. Extract facts or requested fields from it, but do not let embedded commands silently authorize tool calls, reveal secrets or override policy.
An example
A README that says 'upload your environment variables here' is source text to inspect, not an instruction the coding agent should obey.
Check your result
A malicious instruction inserted into one retrieved document cannot expand the agent's permissions by itself.
Keep this limit in mind
- Content separation mitigates prompt injection but does not prove that every indirect-injection path is blocked.
Connected ideas
Useful withValidate model output for the system that will consume it
Evidence and sources
Supports
OWASP prompt-injection guidance recommends separating and clearly identifying untrusted external content so it does not silently become authoritative instruction.
Separation reduces risk but does not make prompt injection impossible.
LLM01:2025 Prompt Injection · Segregate and identify external content