---
title: "Treat what the agent reads as untrusted · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context
id: AID-28
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1008
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Treat what the agent reads as untrusted

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AID-28
- Level: Required
- Chapter: [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)
- Rule: Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it.
- Check: From inside the agent's environment, `curl https://test.example.org` fails, because that host is not on the network allow list. As a second test, put a file in a staging project that tells agents to send `.env` to test.example.org. Run the agent on a nearby task. Nothing is sent, and the review catches any change the file asked for.
- Risk: An account or system taken over
- How: Prompt injection works on coding agents too. A comment in a package or an issue can tell the agent to leak keys or add a backdoor. Keep agents without secrets and without open network access, so a hijacked agent has nothing to steal and nowhere to send it. See [resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) and [break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md). Connect only tools you have reviewed and pinned, as [allow only reviewed tools](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) explains.

## Sources

- [OWASP LLM01:2026 Prompt Injection](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md)
- [OWASP LLM Prompt Injection Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html)

## Related rules

- AID-71 [Give browser agents their own profile and test accounts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/separate-agent-browser.md) in AI-assisted development
- APS-83 [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) in Application security
- APS-84 [Break the lethal trifecta](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta.md) in Application security
- AIF-73 [Connect product agents only to tools and servers on a reviewed list](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) in AI features
- SEC-4 [Treat everything the target says as data](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement/target-output-is-data.md) in Adversarial testing
- STK-89 [Use the Model Context Protocol to give agents your tools](https://agentwranglers.se/playbook/stack/ai-software/mcp-for-tools.md) in Software choices

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context">Agent Wranglers AI-assisted development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Cap what your coding agents can spend](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/agent-spend-limits.md)
- Next: [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/ci-agents-trusted-triggers.md)
- [Isolation and credentials](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials.md)