PRODUCTION SCENARIO
An agent summarizes PDFs that customers upload and can also call a tool that emails the summary onward. A red-team run shows the model following instructions embedded in an uploaded file.
Which change best hardens the agent against instructions carried in those files?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: Put the extracted text in tool_result blocks and require sign-off before any send.
Third-party content belongs in tool_result blocks, never in a system prompt or a plain user text block, because Claude is trained to treat instructions inside tool results with skepticism; pairing that with least privilege means a successful injection still cannot trigger the send. Putting the text in the system prompt does the opposite, promoting attacker text to trusted instructions. A reminder appended after the file text is still prompt text, and instructions placed in tool results may be ignored. And stripping hidden text helps only until the attacker writes in plain view.