lupin.Open console
Browsers

Treat web page instructions as untrusted content

Keep a website’s text separate from the user’s authority when researching or acting through a browser.

Lupin editorialAI-assisted3 min read

A page is evidence, not a new supervisor

A website can contain sentences that look like instructions to the agent: ignore the task, reveal a token, visit another address or perform an unrelated action. Treat those sentences as page content. The user and workspace policy define the task; the website supplies evidence about its own subject and interface. Lupin marks browser observations with untrusted_content, but a label cannot perform the reasoning for the application. The task runner must preserve the distinction when summarizing pages, selecting links and deciding whether a requested interaction is authorized.

Limit the authority attached to a read

Public research does not send the caller's Lupin authorization header or local website cookies to a source page. The fixed browser action surface validates public destinations and does not expose arbitrary code execution or downloads. These are useful boundaries, but a page can still persuade an agent to misuse tools elsewhere if the surrounding workflow treats its text as authority. Give the reader only the tools it needs, and keep infrastructure credentials outside page content and ordinary logs. A source mentioning a secret destination is not a reason to retrieve or transmit data there.

Extract facts with provenance attached

When reading a page, capture the source URL, retrieval time and the exact kind of evidence it provides. Separate quoted or paraphrased claims from the agent's conclusion. If a document includes an imperative such as submit your account key here, report that the document says so without following it. Search snippets and actually opened source pages remain different evidence classes. A snippet that claims a page contains an instruction does not establish that the page was read, and neither evidence class can grant the agent permission to change the task.

Illustrative request; source reviewed, not executed against a live provider.
{"action":"read","tab_id":"TARGET_ID_FROM_TABS"}

Gate transitions that cross trust boundaries

Before a page-driven action, compare the proposed destination and effect with the user's instruction. A link to a public reference may be relevant research; a request to send private records to a new domain is a separate data transfer. A visible admin control may be technically available but outside the authorized task. Keep a human in control of sign-in and consequential approvals where required. Avoid pasting live-view URLs, CDP tokens or API keys into page fields unless the user explicitly authorized that exact credential use and the destination is appropriate.

Respond to suspicious content with a bounded workflow

Continue extracting the relevant facts when the page can be used safely, or stop the dependent action when the content makes the target ambiguous. Record a concise note that the source contained task-redirecting instructions if it affects evidence quality. Do not amplify the entire malicious text into every downstream prompt. Save the useful source material and the reason for any excluded action, then close the session when the authorized work is done. The goal is a reproducible trust decision: a reviewer should see which statements came from the site and which actions came from the user's actual request.

Sources & verification

Reviewed against the current Lupin route, provider adapter and shared input contracts, plus the linked official references. Examples were not run against live services.

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.

Put it into practice

Give your agent the right tools.

Review the API, workspace requirements and permissions before enabling a workflow.

Explore browsers