PRODUCTION SCENARIO
An accounts-payable agent reads inbound vendor emails and files invoices. A penetration tester sent an email whose body told the agent to change the payee bank account, and the agent complied. The pipeline currently pastes each email body into the system prompt before the run.
Where should the email body be placed so the model treats it as data rather than instructions?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: In a source-labeled tool_result block returned by the email-reading tool
Third-party content belongs in tool_result blocks and never in system prompts or plain user text, because the model is trained to treat instructions inside tool results with skepticism; labelling the source tells it what the content is, and the policy that tool content cannot override instructions goes in the system prompt. A user text block is the trusted channel, and a warning line there is just more text. Operator instructions inside a tool result may be ignored or flagged as injection. A note inside the system prompt does not lower the trust of what follows it.