Help center

Home AI and Local Automation[AI-011] A document attempts to override assistant instructions

AI and Local Automation8 min•Difficulty: Avanzado

[AI-011] A document attempts to override assistant instructions

Treat retrieved pages and documents as untrusted data, not as system instructions.

Ingeniería de Integraciones AnayilUpdated: 2026-10-10

Apply this guide to your situation

This answer covers “[AI-011] A document attempts to override assistant instructions”. Read it with the summary and confirm that the symptom and service match what you are experiencing. Available options can vary by plan and account setup.

Before changing anything, note what you expected, what happened and roughly when. Check whether the issue affects one page or the whole service.
Save the full error message and note recent changes. Hide passwords, access codes, personal data and keys before sharing screenshots or logs.
If a step requires administrator access, restarting services or editing server files, stop if you do not administer that server. Send support the service name, error and checks you have already made.

L3 technical diagnosis

Integration / security / operationsSeverity: Medium; high for data exposure or duplicated actions

User symptoms

The assistant follows instructions embedded in an email, web page or file and reveals or changes information.

Observed code or message

Output contains a secret or runs an unrequested action after retrieving content

Likely root cause

Prompt injection can arrive through external RAG content, images, HTML, messages or tools. Delimiters help but do not replace permission controls or validation.

Likely-cause and resolution matrix

Follow a branch only when evidence supports it. A symptom may have more than one cause; do not change layers by guesswork.

01Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

02Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

03Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

04Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

05Professional English translation pending.

Why it can happen: Professional English translation pending.

How to diagnose (read-only):

bash

Professional English translation pending.

Step-by-step resolution:
Professional English translation pending.

Prerequisites

Authorised access to the involved runtime, provider or automation.
A test environment and synthetic data; never use customer prompts for diagnostics.
A technical owner who can approve network, secret, GPU or resource changes.

Important warnings

Do not expose local inference endpoints or webhooks without appropriate authentication, TLS and limits. Never put API keys, private prompts or personal data in commands, screenshots or logs.
Commands are diagnostic references. Production changes, Docker/firewall rules and credential rotation require service-owner authorisation.

Step-by-step walkthrough

1. Confirm the symptom and scope

The assistant follows instructions embedded in an email, web page or file and reveals or changes information. Reproduce with a harmless test document asking the model to ignore rules. Review the final prompt, retrieved sources, available tools and sanitised logs.

bash

# Check that secrets are not interpolated into prompts or logs
rg -n 'API_KEY|Authorization|process.env|tool' src app

Expected output:

Output contains a secret or runs an unrequested action after retrieving content

2. Correct the responsible component

Label and delimit sources as untrusted data; give each tool least privilege and validate every argument/action outside the model. Require confirmation for sensitive actions and never place keys or secret instructions in retrievable context.

3. Verify and close exposure

Run a controlled adversarial corpus; the model may quote the attempt as content but must not reveal secrets, escalate privileges or invoke tools outside policy.

Expected output:

The check confirms the expected result without exposing services or data.

Troubleshooting & Solutions

Output contains a secret or runs an unrequested action after retrieving content

Root cause: Prompt injection can arrive through external RAG content, images, HTML, messages or tools. Delimiters help but do not replace permission controls or validation.

Resolution: Label and delimit sources as untrusted data; give each tool least privilege and validate every argument/action outside the model. Require confirmation for sensitive actions and never place keys or secret instructions in retrievable context.

Rollback and recovery plan

Restore the last approved configuration, stop the affected workflow and revoke any exposed credential. If real data was processed through an unauthorised path, retain minimal redacted records and follow the internal incident-response process.

Related runbooks in this category:

[AI-001] The local Ollama endpoint does not respond8 min [AI-002] The Docker application cannot reach the local model8 min [AI-003] Model download fails because of disk space or incomplete storage8 min

Was this technical guide helpful?

Facing a production outage?

Hosting Anayil system administrators can directly intervene on your server infrastructure.

Open Support Ticket at Hosting Anayil