Know what the platform defends

Your agent reads text that other people wrote, and some of that text tries to steer it. This page states where that text enters, what the platform bounds, what it does not, and what you own as a result.

Behavior here was checked against the shipped platform on 2026-08-31. It is current behavior, not a commitment.

This page uses task for the end-to-end request, delegated task for work handed to another agent, and model interaction for one model request and response inside either task.

Where text you do not control enters

Each source below reaches the model as ordinary text. You wrote none of it at the moment the model reads it.

The last row separates this from ordinary input validation. Every source feeds one context, and what the model does next feeds that same context again:

How text an outsider wrote reaches the model and comes back as an actionSix sources feed the model's context: a document in a Library, a search result title or extract, a web page an agent fetched, the result your tool returned, the output of a program the model wrote, and earlier model output. The model reads that context and chooses the next step, which can invoke one of your tools, fetch another page, or run another program. Each of those writes its result back into the context, so text that arrived in one model interaction keeps steering later interactions.

Text that steers the model early in a task can keep steering it until the task ends.

Prompt injection is not solved, here or anywhere

The platform does not identify and remove embedded instructions before it gives extracted text to the model. Extraction can change the format or omit content; it is not a security filter.

No platform can guarantee prevention. OWASP Top 10 for LLM Applications 2025, LLM01: Prompt Injection (opens in a new tab) states that no foolproof prevention method is known. The UK NCSC article Prompt injection is not SQL injection (opens in a new tab) calls a language model an inherently confusable deputy. It says to reduce the risk and impact instead of claiming to remove them. Both sources were checked on 2026-08-31.

One rule follows:

Treat every retrieved passage, search extract, and fetched page as hostile data. Put your controls in your tool code, where they run deterministically.

A system instruction saying “do not delete records” is a preference. A check inside the tool that deletes records is a control. Secure integration shows where those checks go.

Duale AI publishes no measured prompt-injection resistance rate. Your assessment must also cover the model providers you select, the tools you write, and every external service those tools call.

Three properties together trigger this gate

For prompt-injection risk, put a human decision or deterministic check before an external action when the agent has all three properties:

1. It reads content you do not control.
2. It can reach data that matters.
3. It can change something outside the platform, or send a message.

The three properties that together require a gateThree properties combine. The agent reads content you do not control. The agent can reach data that matters. The agent can change something outside the platform or send a message. An agent holding all three needs a human decision or a deterministic check before it acts outside the platform. Removing any one property removes this prompt-injection-driven condition, but it does not remove every approval need.

Removing one property removes this prompt-injection condition. It does not remove a legal, financial, or business approval requirement.

If an agent needs all three properties, add the gate before it acquires the last one.

Remove one property instead

You can also remove one property:

The third move also survives a replayed tool call.

What the platform bounds

These bounds hold with no configuration from you. None of them decides whether an action is allowed. Each one limits how far work runs, or how far it reaches.

The fixed work ceilings reduce the unbounded-consumption risk described by OWASP (opens in a new tab). They do not replace your own admission, concurrency, deadline, or spend controls.

You can verify the upload scan in a non-production Library with the official EICAR anti-malware test file (opens in a new tab). The document must end in failed with MALWARE_DETECTED, and no text from it must become searchable. Manage a Library states the integrity and malware outcomes to check.

Controls your integration must add

Each item below is a control a reader assumes exists.

• No per-action authorization. The platform checks that your agent can call your tool. It does not check whether this call, with these arguments, is one you want to allow.
• No human approval step. The platform builds none. Your integration must obtain the decision, and your tool code must enforce it before a side effect.
• No tool allowlist per request. A task cannot narrow the tools available to its coordinating agent. The dedicated Web research executor has a separate fixed tool surface and cannot call your registered tools.
• No prompt-injection filter for what an agent reads. Extracted document text, search extracts, and extracted page text can carry third-party instructions into the model context that reads them.
• No guarantee that a browsed page cannot influence later work. Raw page text stays in the Web research context, but its condensed synthesis returns to the coordinating agent and can affect a later tool call.
• No undo. Stopping a task prevents new work. A call already sent to a provider or a tool runs to its end.

Assume that every absence applies. Authorize each call in your tool code. Put approval before high-impact effects. Register only the tools the agent needs.

Treat retrieved text as hostile. Make side effects idempotent and add a compensation path. Secure integration shows where those controls run.

What Web content and a program in the sandbox can reach

Web research starts a fresh, dedicated executor with only the bounded research brief. It does not inherit the parent conversation or document history, cannot call your registered tools, and cannot delegate. Raw search results and page content stay in that research context. The coordinating agent receives a condensed package of claims, sources, excerpts, and gaps.

This separation reduces the direct reach of hostile page text; it is not a content filter. A page can still steer the researcher’s synthesis, and that synthesis can affect later work by the coordinating agent. Keep approval in the code that owns each external effect.

Related page reads by the research executor can carry cookies and site storage. Treat that state as sensitive. Page access does not support sign-in. Web page access states the browser boundary. Data protection states how long saved state can remain.

Page access renders active content. A page or page resource can send additional network requests while it renders, including non-GET requests. A control in your registered tool protects only that tool. It does not authorize or block requests that page JavaScript sends.

A model-written program gets fresh writable state. The platform destroys that state when the code run ends, so nothing the program leaves behind reaches the next run. The program receives its code, packages, and the environment variables the model supplies. It receives none of your process, credentials, or network.

Outbound network starts off for each run. When the model turns it on and names no domains, the program reaches its language’s package registry and nothing else. When the model names domains, it reaches those.

The platform can reuse one package snapshot when separate tenants request the same package set. Read the boundary above as separation from your environment and between the writable state of two runs. Do not read it as a dedicated-tenant sandbox boundary.

Preparing a package snapshot can reach public package registries on a cache miss. This happens outside the code run, so the run’s network setting does not govern it.

Blast radius of one leaked credential

Reading your model-provider configuration returns the provider credential values. Grant that read as you would grant a secret.

Agents and access states which roles carry that read.

Revoking an agent token stops new requests. It does not stop a task already running, which can run for days.

Return to Security to place this threat model in the lifecycle of one task.