The problem does not end when a model interprets an untrusted instruction. Impact depends on which data, tools, outbound channels and memory the influenced model can reach next. This explorer models those paths and the controls that cut them, without generating attack payloads or teaching offensive techniques.
—
—
—
—
—
For indirect content, the component that reads untrusted data should not hold the same authority as the privileged actor.
Reduces available damage after steering; it does not block a binary path by itself or prevent injection.
Checks proposed actions against the original task outside the untrusted-content path.
Places an independent approval boundary before sending, deleting, purchasing, publishing or modifying sensitive state.
Limits destinations and channels capable of moving information beyond the trust boundary.
Stops influenced content from automatically becoming reusable state in future turns.
Can block known secret classes; it does not make every sensitive datum detectable and is only one defensive layer.
Limit: this tool evaluates architectural reachability assuming enabled controls are enforced correctly. It does not estimate the probability that a model follows malicious instructions or the real-world failure rate of any control.
OWASP distinguishes direct and indirect injection and recommends content separation, least privilege, output validation, agent-specific controls and human approval for privileged operations. OpenAI likewise recommends limiting access and reviewing consequential actions.