Contain sensitive data and untrusted input

Tokenize PII in the client so it never reaches the model, wrap untrusted tool and web results in taint delimiters, scan context files and skills for prompt injection, and state an explicit instruction-precedence order (user, repo, defaults, external data as data).

Tier 2 because safety containment.

When it applies

• In the code: PII or untrusted content passed to the model unmarked; no instruction-precedence statement
• In traces: sensitive fields in model inputs or logs; injected instructions followed; failure rows labeled indirect-prompt-injection
• In eval results: injection and data-leak safety evals

How

1. Map where PII and untrusted text enter the prompt.
2. Add tokenization at the client and delimiters on untrusted results.
3. Add the precedence statement to the prompt.
4. Run injection and data-leak safety evals.

How to measure it

• before after (tier 2): injection and data-leak safety evals

To compare the change against your agent's current version, with the same cases and enough repeats to see past run-to-run noise, use aot-evals.

Expected impact

• Quality: none
• Cost: none
• Performance: none

Evidence

Evidence comes from: Tool use, Code generation.

1. Tokenize PII in the MCP clientNot measured

   "The real email addresses, phone numbers, and names flow from Google Sheets to Salesforce, but never through the model. This prevents the agent from accidentally logging or processing sensitive data. You can also use this to define deterministic security rules, choosing where data can flow to and from."

   Adam Jones, Conor Kelly (Anthropic), "Code execution with MCP: Building more efficient agents" · Nov 2025 · Benefits: Privacy-preserving operations

2. State an explicit instruction-precedence contractNot measured

   Mistral Vibe "a formal instruction-hierarchy contract: seven precedence levels ... prompt-injection defense expressed as a ranking rather than prohibitions"; "Critical instructions—not overridable" and "Overridable defaults" sections.

   Barbaste et al., "Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems" · Jul 2026 · Sec 7.3 "Identity and persona", "Emphasis markers"

3. Wrap untrusted tool/web results in taint delimitersNot measured

   Hermes "untrusted tool results wrapped in <untrusted_tool_result> delimiters with lookalike defanging"; OpenHands "repository-derived context is wrapped in <UNTRUSTED_CONTENT> markers".

   Barbaste et al., "Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems" · Jul 2026 · Sec 10.3; Sec 10.7; Table 12 "Untrusted-Content Delimiting"

4. Scan context files and skills for prompt injectionNot measured

   Hermes "every context file is scanned for prompt-injection patterns and blocked wholesale on a match"; "builtin/trusted/community trust tiers and quarantine"; Pi trust-gates repo config but "context files load regardless—a documented, deliberate injection-surface acceptance."

   Barbaste et al., "Harness Engineering: Anatomy, Architecture, and Evolution of Coding Agents -- A Source-Code Study of Eleven Systems" · Jul 2026 · Sec 9.7; Sec 10.7; Sec 10.8; Sec 12.5; Recommendation 14

Also known as

• Dual LLM (privileged / quarantined)
• Context minimization

Related

• 10.a.iConstrain what the agent can touch
• 6.c.iCode-then-execute (CaMeL)
• 4.c.iEpisodic memory retrieval
• 6.b.iiLLM map-reduce
• 6.c.iiPlan-then-execute
• 7.d.iiiReAct loop
• 4.c.iiSkill library evolution
• 5.a.iCompact conversation history in stages: elide stale tool outputs, then keep an anchored summary

In Claude Code

This optimization is a skill in aot-kit, our open-source Claude Code plugin: /aot-kit:contain-untrusted-input. Its library entry holds every source. Have new evidence, or a correction? Suggest a change.