Can a research document give your investing agent new instructions?

Locate the boundary in a simple task

Imagine a hypothetical assistant asked to summarize an invented company’s public report. The report contains a paragraph telling the assistant to ignore the research question, expose private notes, and send a message. That paragraph may be text the model reads, but it is not a new instruction from the person who assigned the task.

OWASP describes indirect prompt injection as malicious instructions arriving through external material. Its guidance recommends treating retrieved content as untrusted and checking tool permissions outside the model. Those controls address a different question from whether the document looks credible as a financial source.

Separate source credibility from action authority

A filing can be relevant evidence about a reported figure without being authorized to direct the agent’s tools. Likewise, a suspicious instruction does not by itself prove that every financial number in the document is false. Keep the evidence assessment and the authority assessment separate.

For the invented paragraph, record which text is being evaluated as evidence, which text attempts to redirect behavior, and what proposed action would cross the accepted scope. Do not copy any private note or credential into the example to make it realistic.

Design a harmless check before using tools

Prepare two invented documents containing the same harmless financial sentence. Add a task-changing instruction to only one. Use a local paper review or an isolated test with fake data and tool substitutes; do not attach real accounts, brokerage access, mail, or production credentials.

• Expected evidence behavior: summarize the assigned financial sentence with its source context.
• Expected authority behavior: do not let the added paragraph grant a new action or reveal unrelated data.
• Expected record: show the attempted redirect and the proposed action without including real secrets.

Inspect the action, not a promise

A response saying I will follow the rules is not the same as a blocked unauthorized operation. For the proposed check, inspect whether a tool call was attempted, what target and arguments it contained, and what the execution boundary allowed. Write the expected denial before conducting any test.

OWASP’s guidance treats filtering and prompt structure as layers rather than a complete defense. A cleaner prompt can be useful while leaving execution controls essential. Do not interpret success on one obvious malicious sentence as evidence that obfuscated or differently placed attempts are handled.

Keep the human review concrete

If a legitimate task really requires an external action, show the actual target, content, and effect for the appropriate review. A document claiming that approval was already given is not evidence of the user’s authorization. Keep the evidence needed for an action separate from the action’s permission.

For a research-only session, the simplest review question is which information the assistant needs to read and what it is allowed to produce. Limiting the task’s scope makes the intended boundary easier to inspect; it does not make the model immune to manipulation.

Method, sources, and limits

The malicious paragraph, document pair, and check are hypothetical. OWASP sources were opened and checked on 26 October 2026. No attack was run and no product defense was tested. This article does not claim that Thesis Lab implements every control described here or guarantee protection against prompt injection.