A few weeks ago, I fed my job-search tool a fake job advert built to hijack it. The post had instructions aimed at the AI that reads each advert for me: ignore your actual job, step outside the advert you're reading, and go find a private key on my computer. It's the kind of scary example that comes up in AI security talks. In my case, however, it isn't just an example: the tool I use to search for jobs reads text from job boards I don't control every time it runs, so who knows what's lurking in there?
So how do you try to harden an AI tool against that? This was what I was thinking when I was trying to make sure my job finder tool was secure — or at least as secure as possible. AI models might choose to obey random instructions from the web, and each model will behave differently. So I thought: if the thing reading the advert had no "hands", it wouldn't be able to follow malicious instructions. Even if the fake advert had talked it into cooperating, there was no path from that sentence to a file on my machine.
An advert is just text, even when it reads like an order
My job finder pulls vacancies from public feeds, reads the full adverts, and asks an AI model to weigh each one against my experience and what I'm looking for. The ones that survive show up in a private dashboard I check later.
Because a job advert is text written by a stranger, and I'm handing it to a system whose whole job is to follow written instructions and potentially has access to my computer, my personal files, everything, I needed to make sure I wasn't opening my computer to malicious intent.
I can give the model hints. Tags that say "this bit is the advert, treat it as data," and an instruction to flag anything trying to override its task. Those help. But it's all still one stream of words arriving together, and the model has to guess which of those words it's meant to take orders from. I didn't want to bet the whole thing on it guessing right. Also, as I recently experienced with Opus 5, even models that are supposed to be frontier-smart can act weird and not that bright. So you can't fully trust that the AI will do what you told it, or that it's even clever enough to spot the difference.
So the real protection sits around it, not inside it.
The part that reads the advert runs off on its own with no tools. It can't open files, run commands, or go online. I hand it the advert as plain text, never as anything it could mistake for a command. And it starts in an empty scratch folder, so there's nothing of mine nearby for it to wander into.
Its answer is boxed in too. It has to come back in a small fixed shape, and plain ordinary code checks every field before anything happens with it. A garbled or self-contradicting verdict just gets dropped. It can't talk its way into my dashboard just because some random paragraph made a convincing case.
If a result looks suspicious, it stays on screen for me to look at. This is because I'd rather look at a false alarm than have job ads disappear just because they look suspicious.
I wanted to watch it fail
When you go looking for security best practices, you come back with a word salad that is potentially meaningless: The agent is "isolated."; The output is "validated." Fine, but what actually happens when the nasty text hits the live model? I didn't want to assume. I wanted to see it.
So I ran the "attack" for real, against the live judge. I made the fake advert try a few different angles, including breaking out of the advert it was told to stay inside, and dangled a bit of bait in a private file. The test came back with a warning flag of maybe, 50. It was almost disappointing how boring that was. The file's contents never showed up, because the judge couldn't read the file in the first place.
A second test caught something quieter. I gave the judge a brief that mentioned nothing about my wider setup, then asked it a question that only someone who'd read my personal settings could answer. It answered correctly. So it was reading those settings, even though I'd never handed them over. The empty scratch folder had blocked the obvious leak, but a second one was open. And from the outside nothing looked wrong, which is why it was easy to miss.
So I cut that off too. Now the only thing the judge gets told is the brief I hand it on purpose. The advert comes in separately, and the rest of my personal AI setup gets no say in the process. This is a security thing, but it's also just plain tidiness: editing some unrelated settings file of mine shouldn't quietly change which jobs I get shown tomorrow.
The instinct came from writing, not code
The job finder is one of a bunch of small tools I've built with AI this year. One's a budget dashboard, another watches public-transport feeds that can go stale. These are different problems, but I keep asking the same question up front: what am I trusting here that I don't actually control?
That's the type of thinking that eventually led me to actually go and look to see if my job finder tool was secure or not. A string of text should stay a string of text, whether it came off a job board or off my own hard drive.
In a way, none of this is new to me. I've spent years as a technical writer poking at where a claim came from and what the next person will do if it's wrong. In a document, a bad source misleads a reader but if you hand an AI agent enough power that same bad source can start giving orders.
The AI is far better than me at remembering syntax. What I'm good at is getting suspicious of anything with too much latitude over my system or my personal information. That's why I'm never totally satisfied with what the AI tells me, so I try to come up with ways to test whether it's really that way.
Let the model be wrong
There's no clean, finished fix for prompt injection. A model can always be swayed by hostile text. I do put clear boundaries in the prompt, and I do ask it to flag injection attempts. I think this is useful and worth doing, but I don't treat them as a lock.
But I guess there are two things I can say about this judge. It has no tools, so it can't open files, run commands, or reach the internet. And plain code checks its answer before anything acts on it. Of course, this all rests on the tools underneath not having a bug of their own that lets the thing go rogue anyway.
A confused model can hand me a weird verdict. That verdict sits there waiting for me and has nowhere else to go. But for something whose only job is to read random text off the internet, I'll take a failure I've boxed in over a polite refusal I can't count on.
Top comments (0)