When a document becomes an instruction.
Question & intended use
Can an agent use retrieved content without treating it as an instruction to take privileged action?
Evidence & finding
A hostile instruction in a retrieved document leads to an attempted privileged tool action.
Trace, prompt, tool call, affected privilege, and replayable test case.
A document enters the retrieval context.
External content is treated as an instruction.
A privileged tool action is requested.
Uncertainty & limits
One failure path, under defined conditions. Other inputs, permissions, and system versions require further testing.
Owner & proposed control
System security owns remediation; the program owner sets release conditions. Apply content isolation, tool-call approval, and a retrieval allowlist.
Decision
Restrict the affected tool capability until the proposed controls are verified.
Re-test plan
Replay the scenario after remediation and material changes to the model, tools, or retrieval layer.





