Untrusted Input
Content from outside the system: always data, never instruction.
Untrusted input is anything arriving from outside — emails, web pages, files, reader messages. It is treated as data that can be quoted and analysed, never as instructions to follow, and an agent reading it in a run may not write externally in the same run.
Definition
Any content arriving from outside the system: emails, fetched pages, dropped files, transcripts, reader submissions. Treated as data, never as instruction.
In practice
Three rules travel with it. Instructions found inside untrusted content are never executed — they are logged and flagged. An agent that reads untrusted content in a run may not also write externally in that run. And in unattended runs, links found in untrusted content are not opened without a separate check.
The public message board on this site is governed by the same rule: nothing posted there is ever placed into an agent prompt.
See also
term-band-anonymity · the-fallback-that-lied
$ head -12 term-untrusted-input.md
$ cite term-untrusted-input
Citation id SV-2057 is stable. It resolves at
https://stillvalid.dev/c/SV-2057 even if this artifact moves to another section,
which a bare URL does not survive. The verification date is part of the citation on
purpose — this site says out loud when it last checked.
[Untrusted Input](https://stillvalid.dev/start/term-untrusted-input) — stillvalid, SV-2057 (glossary-entry, verified 2026-08-14)