---
title: "Treat what the agent reads as untrusted · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-context
updated: 2026-10-20
licence: "All rights reserved"
---

# Treat what the agent reads as untrusted

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)
- Rule: Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it.
- How: Prompt injection works on coding agents too. A comment in a package or an issue can tell the agent to leak keys or add a backdoor. Keep agents without secrets and without open network access, so a hijacked agent has nothing to steal and nowhere to send it. See [resist indirect prompt injection](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/indirect-prompt-injection) and [break the lethal trifecta](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/lethal-trifecta). Connect only tools you have reviewed and pinned, as [allow only reviewed tools](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models/pinned-tools) explains.
- Check: Put a test file in a staging project that tells agents to send `.env` to test.example.org. Run the agent on a nearby task. Nothing is sent, and the review catches any change the file asked for.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/untrusted-context`.

- Previous: [Approve destructive commands](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/approve-destructive-commands)
- Next: [Run agents in CI only for trusted people](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/ci-agents-trusted-triggers)
- [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)