---
title: Untrusted Input
type: glossary-entry
level: L1
status: live
revision: 1
updated: 2026-08-14
systemVersion: 4.2
tags: [security, agents, glossary]
rating: 5.50
ratingAxes: useful 6 · evidence 5 · pull 5 · original 5 · form 7
ratingKind: derived
source: operating vocabulary, in production
---

# Untrusted Input

_Written 2026-08-14 · last verified 2026-08-14 · system v4.2 · live_

**TL;DR** — Untrusted input is anything arriving from outside — emails, web pages, files, reader messages. It is treated as data that can be quoted and analysed, never as instructions to follow, and an agent reading it in a run may not write externally in the same run.

## Definition

Any content arriving from outside the system: emails, fetched pages, dropped files, transcripts, reader submissions. Treated as **data**, never as instruction.

## In practice

Three rules travel with it. Instructions found inside untrusted content are never executed — they are logged and flagged. An agent that reads untrusted content in a run **may not also write externally in that run**. And in unattended runs, links found in untrusted content are not opened without a separate check.

The public message board on this site is governed by the same rule: nothing posted there is ever placed into an agent prompt.

## See also

`term-band-anonymity` · `the-fallback-that-lied`