Malicious instructions in sources: a defensive review for GEO analysis

A source can supply a useful fact about a brand and, in another passage, try to direct the work of the system analyzing it. The problem arises when an AI-assisted review treats that second passage as an instruction: it changes the evaluation criteria, omits a warning or proposes an action outside the assignment.

This procedure is for teams reviewing documents, pages and answers in a GEO audit. It produces a record of suspicious sources, quarantine decisions and workflow tests with external effects disabled. It does not teach manipulation of third-party answers or certify that an application is immune to prompt injection.

The agent-ready website audit checks authorized navigation tasks. This procedure reviews a different boundary: whether content supplied as evidence ends up deciding what the system may do.

Write down the task and its authority before reading

Record what the analysis must produce, which materials it may consult and which operations are authorized. Identify what falls outside the task too: publishing content, contacting a company, changing a record or sharing internal documents.

A vendor name, signature or familiar domain may help assess a statement, but it does not authorize an expanded assignment. Neither does a response from an approved tool. Separate the document's provenance from authority to request actions.

The NCSC warns that content and instructions within a prompt do not form a security boundary equivalent to parameterized queries. This protocol therefore combines document review with environmental limits rather than relying on a sentence asking the model to behave correctly.

Before introducing unreviewed material, confirm with the technical owner what access the reading component retains. If that limit cannot be checked, do not describe the analysis as isolated.

Identify task changes without confusing them with quotations

Look for passages attempting to replace the objective, impose a conclusion or obtain an out-of-scope action. Record the apparent audience and requested change. An instruction aimed at the analyst has a different role from a product's assembly instructions.

Do not decide from a single word. A security document may quote a malicious command to explain it; a manual contains legitimate imperatives. Conversely, a change in evaluation criteria may use no conspicuous language. Review function, context and the requested effect.

Use statuses that do not presume proven intent:

Keep accuracy concerns separate. A source may state a fact faithfully while containing an unrelated instruction; it can also be false without trying to direct the analyst. The audit of citation support for claims handles that other documentary dimension.

Preserve the passage and quarantine its use

Open a record containing the source identifier, original URL or file, consultation date, available version, passage location and reason for concern. Copy only the necessary excerpt and permitted context. Do not transfer private conversations, credentials or other material unnecessary for reviewing the document.

Quarantine means suspending that version's use as a routine input until its treatment is decided. It does not mean deleting the source or declaring it false. Separate the preserved original, working copy and any reviewed extraction.

Store the material in an inspection format that does not automatically turn links, remote images or active content into actions. Do not open destinations proposed by the passage to see whether the instruction works. If technical analysis requires additional access, refer the case to security with the appropriate scope and authorization.

Record which reports or runs already used that version. The record should help locate affected outputs without spreading suspicious content into every follow-up ticket or email.

Separate reading from tool access

Review the text in an authorized environment without production credentials, unnecessary private data or tools capable of changing systems. A reader that does not need to send messages should not have a messaging integration available at this stage.

Ask the technical owner for evidence of the actual limits: exposed tools, permissions, accessible resources and permitted network destinations. A “read-only” label in the prompt does not establish that access is restricted. If the service hosts capabilities you cannot inspect, retain that limitation in the result.

This stage should produce a finding for review, not a ready-to-execute command. A component capable of acting afterward must enforce its own authorization controls, without accepting a sentence from the document or an explanation derived from it as permission.

OpenAI's agent safety documentation recommends constraining external data flow and combining controls while acknowledging residual risk. This procedure uses that principle without becoming an Agent Builder tutorial or depending on its interface.

Extract a reviewable record, not a new authority

Define the fields the reader may produce. For this protocol, use a source identifier, passage locator, description of the deviation, review status, uncertainty and next owner. Source text must not determine field names or add destinations and operations to the contract.

Check types, required fields and permitted values outside the model. Review field contents too: a valid structure can carry an instruction inside a description. Valid JSON is not equivalent to reliable evidence or an authorized action.

The reviewer must be able to distinguish the original passage from its interpretation. Preserve the link to the examined version rather than replacing the passage with a summary that drops the problematic part.

If a useful statement is extracted from a quarantined source, record the extraction as a separate, reviewed artifact. Do not automatically return the entire document to the workflow because one of its statements was corroborated.

Design tests without real data or actions

Test only materials you own or are authorized to use, with fictional data and tool substitutes incapable of contacting real services. Do not paste suspicious content into an assistant with email, private files or write access to see whether it follows it.

Define a harmless task, a permitted result and the deviation you want to detect. Add a legitimate control for the same task to check that the defense does not block everything. A quotation of instructions in an educational document can test contextual review without becoming a user command.

The OWASP prompt injection prevention guide proposes harmless data and instrumented tools for testing. Its warning matters: a refusal in the final answer does not establish that an action was not already executed.

For each test, retain the input version, known configuration, active controls, output and simulated-tool logs. Fix the budget and conditions before starting rather than expanding attempts indefinitely until the desired result appears.

Evaluate observed effects and legitimate cases you block

Decide the outcome from test-environment evidence, not only the model's account. Check separately for changed analysis criteria, suspicious content entering the report as an instruction and out-of-scope calls to simulated tools.

A blocked call, an allowed call and an execution without available traces are different outcomes. Do not turn “not observed” into “did not happen” when the necessary record is missing. If output was restricted to a review record, check that no destinations or actions were added to the next step.

Report counts of suspicious cases, legitimate controls, observed deviations, incorrect blocks and inconclusive outcomes. Retain the denominator and configuration. If only a reader without tools was tested, do not extend that result to the connected agent operating afterward.

Passing these tests does not establish security against every input. Anthropic describes the need for layered defenses and access limits even with models trained to resist these instructions. Do not transfer its research results into a protection rate for your own audit.

Close the case without losing provenance

The decision may be to exclude the version from the workflow, admit a limited reviewed extraction or keep the case pending technical assessment. Record the decision-maker, admitted artifact, permitted task and remaining access. GEO measurement governance supplies ownership and change history.

After fixing the workflow, repeat the affected case and legitimate controls under comparable conditions. Retain the previous version and test limitations. Do not change a source's label to make the report look clean or remove unresolved cases from the denominator.

If there are indications of a real unauthorized action or information exposure, hand the case to the organization's incident process. This editorial review does not replace a security investigation.

You can link these decisions to sources reviewed alongside your visibility observations in Mentio. The procedure does not announce an automatic prompt injection detector, an isolation environment or a security certification for the product.

Frequently asked questions

Can a source cited by an AI instruct the analyst? It can contain text that attempts to, but appearing in a citation gives it no authority. The task and permissions come from the authorized assignment, not the consulted page or document.

Is removing suspicious phrases enough? No. Text cleaning can be an auxiliary control, but it does not establish isolation or prevent every form of deviation. Check the component's access and review what it passes to the next stage.

Does quarantining a source mean it is false? No. It suspends routine use while that version is reviewed. Factual accuracy and the presence of unrelated instructions are different dimensions and should retain separate decisions.

How can these controls be tested without affecting others? Use authorized materials, fictional data and simulated tools without external effects. Define the task, deviation, legitimate control and expected evidence before running; do not test with real credentials or services.

Does a model refusal establish that the test passed? Not by itself. Check outputs and recorded calls throughout the test. A final refusal does not reverse an earlier action, and missing traces can leave the outcome inconclusive.

Want to know if AI mentions your brand?

Discover your visibility in ChatGPT, Claude and Gemini in minutes.

Analyze your brand for free

Related articles