FDE ForgeBeta
Start free
Week 10 · Field delivery

The document that gives orders

0:00 / 3:00

15 seconds

The PDF said "ignore policies."

A malicious note in a ticket tried to redirect the agent. It almost listened.

Retrieved textUntrustedTreat as dataQuarantineAgentFollows system only
Lesson notesThe document that gives orders: the short version+

Week 10 · AI security & red teaming · about 3 minutes

What you will be able to do

Treat retrieved Helix text as data, never as instructions the agent must obey.

The idea

Anything retrieved is untrusted content. Never promote it to system instructions.

Delimiter, tool allowlists, and refusal policies exist because documents lie.

system = TRUSTED_POLICY
user = question
context = f"<data>{chunks}</data>  # never elevate to system"

If a document can change your tools, you already lost.

Key takeaways

  • Never elevate retrieval to system.
  • Allowlist tools.
  • Assume docs attack you.

Part of the Forward Deployed Engineer roadmap. New to the role? Start with what a Forward Deployed Engineer does.