Bảo mật nhắc nhở AI

Separate the user’s authorized task from the content being processed. A document may legitimately contain instructions as part of its subject matter. Those words should not automatically control the assistant’s tools, account access, or response policy. Keep privileges narrow. A summarization task generally does not require unrestricted file access or permission to send messages. Enforce those limits in the application so a model error cannot silently create a broader capability. Validate consequential outputs and actions against the original request. Check the destination, affected records, data being transmitted, and required approval. An external page claiming that the user approved something is not equivalent to an actual user instruction. Build regression cases that vary the location and format of untrusted instructions. Test direct input, retrieved passages, and tool results in a controlled environment. Review whether the application preserves useful task performance while resisting redirection. Avoid claims of a foolproof prompt-injection filter; layered controls and ongoing testing are more credible.