{"training":{"id":"T-INJECT-1","slug":"instructions-hidden-in-content","title":"Instructions hidden in content","policyId":"P-PROMPT-INSPECT","minutes":3,"version":1,"lang":"en","assignment":{"happened":"On {date}, {agent} on {device} read content through {via} that held instructions written for the agent; {blocked}.","matters":"A {minutesWord} training shows how text hidden in an email, an issue or a web page can steer your agent, and what stops it."},"lesson":[{"id":"what-happened","heading":"What happened on {device}","body":["On {date} at {time}, {agent} on {device} read content through {via} during a session: {session}. qcontrol recorded it as: {evidence}.","The content held text written for the agent, not for you, so the policy {policy} recorded a finding. {outcome}"],"illustration":{"scene":"hidden-instruction","alt":"{agent} on {device} reads content through {via}; a line in it, hidden from the reader, addresses the agent.","animated":true}},{"id":"one-context","heading":"Why an agent follows text it reads","body":["When you ask an agent to summarise an email or work through an issue, everything it reads lands in one place: your request and the content's own words. A sentence in the content that reads like an instruction can be taken as one.","The sentence can be hidden from you. White text on a white page, a comment in a web page, a note in a file's details: you never see it, and the agent reads all of it."],"illustration":{"scene":"one-context","alt":"Your request and the hidden line sit together in what the agent reads, with nothing to tell them apart."}},{"id":"what-qpoint-does","heading":"What Qpoint does about it","body":["Prompt inspection reads what your agent reads and checks it for these patterns: {heuristics}. {heuristicsOffSentence}","It records what it finds and cannot stop the agent. What stops the next step is an approval: the agent asks before it sends, posts or deletes, and you decline."],"illustration":{"scene":"mode-observe","alt":"{agent} on {device} carries on, and qcontrol records a finding beside it.","animated":true}},{"id":"instead","heading":"What to do instead","body":["Treat what an agent reads from outside as material, not as instructions: mail, issues, web pages and files from other people.","Keep your agent asking before it sends, posts or deletes anything, and do not approve those steps for a whole session.","When the agent proposes a step you did not ask for, decline it and tell {owner} what it proposed. If it already acted, say what it did; that is the first thing {owner} needs to know."],"illustration":{"scene":"approve-send","alt":"{agent} asks before it sends anything, and you decline a step you did not ask for."},"instead":true}],"check":[{"id":"q-why","prompt":"You ask your agent to summarise an email. A line in it, invisible to you, tells the agent to send your files somewhere. Why might the agent do it?","choices":[{"id":"a","text":"It can't; an agent only follows what you type"},{"id":"b","text":"Only if the email comes from someone in your company"},{"id":"c","text":"It reads the email's words the same way it reads your request","right":true}],"explain":"The agent reads your request and the email's words together, so an instruction in the content can be taken as yours.","stepId":"one-context"},{"id":"q-inspect","prompt":"Prompt inspection flagged a hidden instruction in what your agent read. What did that stop?","choices":[{"id":"a","text":"Nothing on its own; it records, and an approval stops the next step","right":true},{"id":"b","text":"The agent's next tool call"},{"id":"c","text":"The content, which is removed before the agent reads it"}],"explain":"Prompt inspection records what it sees. The approval your agent asks for before it sends, posts or deletes is what stops the next step.","stepId":"what-qpoint-does"},{"id":"q-propose","prompt":"Your agent is working through a web page and proposes sending a file to an address you have never seen. What do you do?","choices":[{"id":"a","text":"Approve it; the agent knows the task"},{"id":"b","text":"Decline it, and tell {owner} what it proposed","right":true},{"id":"c","text":"Approve it once and watch what it does next"}],"explain":"A step you did not ask for is the sign. Decline it, and tell {owner} what the agent proposed.","stepId":"instead"},{"id":"q-setting","prompt":"Which setting gives a hidden instruction the least room to act?","choices":[{"id":"a","text":"Let the agent run every tool without asking, and read the log afterwards"},{"id":"b","text":"Summarise only content from people you know"},{"id":"c","text":"Have the agent ask before it sends, posts or deletes","right":true}],"explain":"An agent that asks before it sends, posts or deletes gives you the moment to decline.","stepId":"instead"}],"contact":{"owner":"{owner}","how":"Contact IT from the message that brought you here, or reply to it; the replies reach {owner}."},"library":{"lesson":[{"id":"what-happened","heading":"What happens when an agent reads hidden instructions","body":["An agent reads content from outside in the middle of a session: an email through a mail server, an issue, a web page. qcontrol sees what it reads on {device}, and prompt inspection checks it.","When the content holds text written for the agent, not for you, the policy {policy} records a finding."],"illustration":{"scene":"hidden-instruction","alt":"{agent} on {device} reads content from outside; a line in it, hidden from the reader, addresses the agent.","animated":true}}],"check":[]}},"version":1,"contentHash":"sha256:188fc4696bbc771738d9aa0d9b254a00159da2f3bbe5b3097408763d8c8ddc58","slots":["agent","blocked","date","device","evidence","heuristics","heuristicsOffSentence","minutesWord","outcome","owner","policy","session","time","via"],"path":"app/data/trainings/en/instructions-hidden-in-content.md"}