Instructions hidden in content

The shape of the real thing#

This is not a laboratory concern. A sales enquiry can carry a paragraph in white text asking the reader's assistant to forward the mailbox elsewhere; a supplier's PDF can end with a line addressed to whatever system is reading it; a web page fetched as a source can contain a block that looks like a system prompt. All three arrive through channels a business must keep open.

The defence therefore cannot be to refuse strange mail. It has to be that text from outside never becomes instruction, whatever it says about itself. The engineering note prompt injection arrives as ordinary business mail works through why that framing beats filtering.

What is removed before anything reads it#

• Zero-width characters — joiners, non-joiners, word joiners, the byte-order mark — are deleted. These are how a paragraph is made invisible to a person and legible to a machine.
• Non-printing control characters become spaces, so a word cannot be split invisibly to slip past matching.
• Line endings are normalised and runs of whitespace collapse, which removes the trick of pushing content off the visible area with hundreds of blank lines.

Removal happens before scanning, so a marker cannot hide behind formatting, and before chunking, so the stored passage is the cleaned text rather than the original bytes. The original file is still kept untouched and hashed — cleaning is what gets indexed, not what gets archived.

What is flagged, on two separate paths#

The patterns cover the recognisable families: overriding prior instructions, asking for a system prompt or credentials to be revealed, impersonating a system or developer turn, disabling safety or approval, asking for a command or a tool to be run, and asking for mailbox or customer data to be sent onward. They are deliberately narrow and deterministic, so that a hit is explainable and a person can read the matched text.

Why a flag is not a deletion#

A legitimate document can contain examples of exactly what the scanner looks for — a security policy teaching staff how to recognise an attempt, a training note quoting one. Deleting or silently sanitising those would destroy the document's meaning and hide the evidence.

So a person may review warnings and approve them with a note. The approval is bound to a fingerprint of the file hash and the exact warnings approved, which means it applies to that state of that document and nothing else. Replace the file and the approval lapses. Conflicts, unlike warnings, cannot be approved this way at all.

The structural defences that do the real work#

1. Content is never instruction authority. A file of instructions becomes behavioural direction only when a person marks that source owner_instruction or playbook.
2. Extraction of PDFs, images and video runs under a fixed instruction to treat the file as data and to quote any AI-directed lines under a heading rather than follow them.
3. Contradiction checking quotes both documents as untrusted data on both sides of the comparison.
4. Retrieved reference material is labelled in the context block as background that must not be stated as current fact.
5. Commitments require authority a fetched document cannot grant itself, so persuading the model proves nothing if the sufficiency gate says no.
6. Research results that look like injected instructions are refused outright rather than summarised.

None of this is a guarantee, and claiming one would be the least useful sentence on this page. Pattern lists are evadable by anyone who reads them. What the layers above buy is that evading the scanner leaves an attacker holding text that still cannot authorise a claim, still cannot call a tool, and still cannot promote itself — because those doors are not opened by words at all.

Questions#

Related#

• Knowledge sources
• Extracting text from a source
• Prompt injection arrives as ordinary business mail
• Security and isolation
• Who decides what is true
• Building an agent on Connect safely