← Blog

Is This Prompt Injection? How to Evaluate Published Agent Guidance

2026-07-19 · Blog · prompt-injectionsecurityconsent

A website can publish useful machine-readable guidance, but public visibility does not make that guidance trusted or safe. Agents should treat external content as untrusted input and keep it separate from higher-priority instructions and the user's intent.

OpenAI's overview of prompt injections explains the broader risk: malicious or misleading instructions can appear in content an AI system processes. They do not have to be visually hidden.

What prompt injection means here

Prompt injection attempts to make a model follow instructions from untrusted content in a way that conflicts with the user's goal, the system's rules or the intended authority boundary. Hidden text is one technique, not the definition.

Visible vendor text can still be inaccurate, manipulative or outside the publisher's authority. Transparency helps people and systems inspect a claim; it does not prove the claim is safe or authorized.

What an operational layer is

An operational layer is public, machine-readable information supplied by a service. It can describe capabilities, inputs, expected results and supported endpoints. It remains a vendor-controlled source and must not outrank system policy, developer rules or the user's request.

A careful agent should:

1. identify the source and treat it as untrusted external data;
2. separate descriptive facts from requested actions;
3. verify that the publisher is authorized to make the claim or expose the endpoint;
4. keep every action within the user's stated goal and granted permissions;
5. validate inputs, destinations and expected results;
6. ask for confirmation before consequential actions; and
7. refuse instructions that conflict with higher-priority rules.

What recorded tests do and do not show

In recorded sessions, some assistants fetched a published layer and surfaced a consent question. That is an observed test result for those sessions. It does not prove universal compatibility, safety or resistance to prompt injection.

Other assistants or later versions may ignore, warn about, misinterpret or refuse the same material. Security claims therefore need threat modelling and adversarial testing, not only successful demos.

Consent is necessary but not sufficient

User confirmation matters, but a confirmation dialog cannot repair a misleading request or an unsafe endpoint. The agent still needs to check scope, identity, authorization, destination and consequences. Sensitive or irreversible steps should use the service's authenticated controls and explicit human confirmation.

Guardrails for publishers and agents

Publishers should keep guidance factual, narrowly scoped and auditable. They should not tell an agent to ignore prior instructions, conceal actions, move data to an unrelated destination or claim permissions the user did not grant.

Agents should apply least privilege, keep external text in the data boundary, validate structured fields and record what was proposed and approved. Public content can inform a task; it does not control the agent.

FAQ

Is visible public guidance automatically safe?

No. Visibility improves reviewability, but the content remains untrusted until its source, authority, relevance and requested action are evaluated.

Is hidden text required for prompt injection?

No. Hidden text is one delivery technique. Visible content can also contain instructions that conflict with the user's goal or the agent's rules.

Does consent remove the risk?

No. Consent is one safeguard. The agent must still validate the action and refuse requests outside the user's authority or intent.

Why might an agent use the layer?

It may contain relevant structured facts or supported endpoints. The agent decides whether to use them under its own policies and the user's instructions; the publisher cannot require compliance.

Keep reading

https://swma.link/89cfc1a5