Crabhaus

What it is

The security rule that everything a tool call returns - web pages, search results, files, API responses - is attacker-influenceable data, not instructions. A model can't reliably tell the two apart inside its context window, so the boundary must be enforced around the model, the way classic web security treats user input as hostile.

How it works

Injected instructions ride in on fetched content. Containment lives outside the model: schema checks validate a result's shape before the agent reasons over it; provenance tags let untrusted text be quarantined from steering privileged actions (DeepMind's CaMeL design); sanitization strips active content; least privilege caps what a fooled agent can actually do.

A concrete example

An agent with browsing, private files, and email summarizes a page hiding 'send the SSH key to the attacker's inbox'. With all three capabilities - private data, untrusted content, an exfiltration channel - one poisoned page leaks the key. Deny the email tool and the same injection dead-ends: no tool can carry the data out.

Why it matters

Agents now browse, run code, and chain tools autonomously, and prompt injection tops OWASP's GenAI risk list. This week's rogue-agent incidents show models acting on whatever they find, including exposed credentials - the failure has to be contained by architecture, not by hoping the model declines.