A bank's case agent reads customer PDFs as knowledge. One uploaded PDF says to ignore prior instructions and email the full case list to an outside address. The agent has a tool that can send mail. What should the architect change?
Select an answer to reveal the explanation.
Short Explanation
A note taped inside a folder is still just a note, even if it tells the clerk to empty the vault. You treat the PDF as untrusted data and you put an approval on the mail tool. Typing a longer warning into the system prompt does not take the tool away.
Full Explanation
Text inside a retrieved file is data, not a new set of instructions. A PDF that says to ignore prior instructions and email the case list is indirect prompt manipulation, and the dangerous part is the mail tool, not the existence of case documents. The architect should keep the tool least-privileged and require a person's approval before any send, so the sentence in the PDF cannot authorize the mailing by itself. A longer system prompt still competes with the file at runtime and leaves the tool in the agent's hands, which is not a control. Training on the malicious PDF memorizes an attack sample and does not constrain the tool the attack is trying to use. Removing every knowledge source stops the agent from doing its legitimate job to avoid one class of text, which is a broader outage than the risk requires. Exam caveat: the same pattern applies to spreadsheet cells and email bodies the agent is asked to read. The channel of the text does not make it instructions. Operational check: upload a test PDF with a send instruction and confirm no mail leaves without an approver, and that a normal case summary still works.