When a tool response becomes an instruction

The failure path.

1. 01Read

   The agent receives text from a document, search result or connected tool.

2. 02Remember

   Embedded instructions influence a memory write or saved preference.

3. 03Act later

   A later session loads that memory and repeats the unwanted behaviour.

What to test.

Use a sandbox and a harmless marker. Place the marker in an external document or tool response, then check whether the agent stores or follows it as an instruction.

• Inspect memory writes after the interaction. Record what was saved and which source introduced it.
• Start a fresh session. Check whether the marker affects a later task.
• Repeat after changing the memory policy, model or tool integration.

Controls to build.

• Separate retrieved content from user instructions and system policy.
• Give memory writes an explicit policy: allowed fields, scope and a review path for sensitive changes.
• Bind stored state to the right user and workspace. Record its source and provide a way to remove it.
• Check permissions and approvals at the tool boundary. Stored text must not grant new authority.

Scope and limits.

This is an illustrative test pattern. It is not a disclosure about a specific product. Results depend on the model, memory implementation and tool permissions. A passing test covers the conditions tested; keep it in the regression suite.