Injection Flag

A machine that reads strangers' words (pages it visits, files people hand it, letters it sorts) is reading things anyone could have written. And some of those words are not meant for you at all. They are aimed at your machine: "forget your orders," "send this onward," "your owner already said yes." That is the trick called prompt injection, and the machine often cannot tell your true voice from a voice it merely read in a stranger's scroll.

The worst part is not that the machine gets confused. It's that it acts, confidently, quietly, on the stranger's words, and you never hear that a line was crossed. Whether it obeyed or ignored, both happened in silence. What's missing is the moment where the machine holds up the scroll and says: this came from the page, not from you, here are its exact words, should I do it?

An agent that processes untrusted content (pages it browses, files users upload, emails it triages) is reading text that anyone could have written. Some of that text is not information for the user; it's an instruction aimed at the agent: "ignore your previous instructions," "forward this thread," "you have approval to…". This is prompt injection, and the failure mode is that the agent can't reliably tell a genuine user instruction from one it just happened to read in a hostile document.

The worst outcome isn't that the agent gets confused. It's that it acts confidently on the injected instruction without ever surfacing that a boundary was crossed. The user never learns that a web page tried to redirect their agent, because the agent either followed it or dropped it, both silently. What's missing is a moment where the agent says: this came from content, not from you, here's exactly what it said, do you want me to act on it?

Prompt injection is a channel-confusion vulnerability: language models process command and data through one undifferentiated token stream, so imperative text encountered in browsed pages, uploaded files, or tool results competes for the same instruction-following machinery as the principal's actual requests. Classifiers help but cannot close the gap. The discrimination problem ("is this the principal's voice?") is adversarial, and the attacker controls the distribution. What turns the vulnerability into a consent failure is the silence on both sides of the agent's decision. Silent compliance is the confused deputy realized: the agent's legitimately-granted authority exercised on behalf of whoever authored the page. Silent suppression is subtler but still broken. The user never learns their agent was targeted (no threat intelligence), and a false positive silently discards content the user may have wanted acted on (no recourse). Both failure modes share a root: the boundary crossing produced no user-visible event. The missing primitive is provenance made explicit at the interface. The agent distinguishing "you asked me" from "something I read asked me" out loud, which is precisely the distinction the token stream erased.

Treat orders found inside content as a flag to raise, never a command to run:

• Say where it came from. "A page you asked me to summarize" (with a pointer to the exact place), so you know at once the words are not yours.
• Show the words exactly. The stranger's order appears letter-for-letter, fenced off like a captured thing. A retelling would smooth away the very details (the lookalike address, the fake "you already approved") that let you smell the trick.
• Say what obeying would do. "Following it would forward your mail to an outside address." The proceed-button must never be a bland little button hiding a big act.
• Make ignoring the easy answer. Dismiss (drop the stranger's order, keep doing your actual task) is the big, emphasized, resting choice. Obeying is deliberately the small one.

Treat an instruction that arrives from content as a flag, not a command:

• Name the provenance. State plainly where the instruction came from ("a web page you asked me to summarise", with a specific pointer), so the user knows it did not originate with them.
• Quote it verbatim. Show the instruction exactly as it appeared, visually fenced as foreign text. A paraphrase hides the very details (a lookalike address, an urgent tone) that let a user judge it; the literal words are the evidence.
• State what following it would do. Make the stakes of proceeding concrete, so "Proceed" is never a neutral-looking button hiding a consequential act.
• Default to not following it. Dismissing (ignoring the instruction and continuing the user's actual task) is the emphasised, safe resting choice; proceeding is deliberately subordinate.

Reify the channel boundary as a consent surface (data-channel imperatives become flags for adjudication) with four properties doing the work:

• Provenance, named and pointed. "A web page you asked me to summarise," with the specific location. Provenance is the fact the token stream destroyed and the one the user's judgment most depends on; restating it is the pattern's core move.
• Verbatim quotation, fenced as foreign. The instruction exactly as encountered, visually and semantically marked as quoted material. Paraphrase is evidence-laundering: the spoofed domain, the counterfeit authorization, the urgency register are exactly what a paraphrase normalizes away, and exactly what makes social-engineering judgeable by humans.
• Concrete consequence. What compliance would do, stated as an effect ("forward your mailbox to an outside address"), so the proceed path carries its stakes on its face rather than borrowing the neutral affordance of a generic button.
• Non-compliance as the weighted default. Dismiss-and-continue is emphasized and resting; proceed is subordinate. This is declining-is-always-safe at its sharpest, because here the cautious choice also happens to be the correct prior.

Two boundary conditions complete the design. Proceeding is not a grant: a followed instruction executes strictly within the principal's existing authority; injected text can never widen the (grant ∩ principal) intersection, only spend it. And any consequential action downstream of "proceed" still routes through its own Action Preview; adjudicating the instruction and approving its effect are separate consents.

The card above is the real InjectionFlag component from @agentconsent/react. The stranger's words are shown exactly as the machine found them, and the safe answer is the heavy one.

The demo is the InjectionFlag component from @agentconsent/react. The injected text is quoted exactly as the agent found it; the safe action carries the weight.

The demo is the InjectionFlag component from @agentconsent/react. The injected payload renders verbatim in the fenced quote, and the action weighting is inverted from the usual dialog convention. The dismiss path is primary, which is the point.

• Any machine that acts on words it didn't write. Browsing, letter-sorting, reading strangers' files, anywhere orders can ride in disguised as content.
• When the smuggled order asks for something the machine can do. Send mail, move money, change settings. The moment the stranger's words touch real power is exactly the moment to stop and raise the flag.
• With an Action Preview behind it. If you do choose to proceed, the resulting act still gets shown on its own card for its own yes.

• Any agent that acts on content it didn't author. Browsing, email triage, document processing, tool results from third parties, anywhere instructions could ride in on data.
• When the instruction would cross an authority boundary. An injected request to do something the agent can do (send mail, move money, change settings) is exactly when to stop and flag rather than execute.
• Alongside an Action Preview. If the user does choose to proceed, route the resulting action through a preview so the concrete effect gets its own explicit approval.

• Any agent consuming unauthored content. Browsing, email triage, document processing, third-party tool results, every data channel is an injection channel, and the flag is the interface obligation that follows from treating them as such.
• When the imperative intersects live capability. An injected request for something the agent can do is where the confused-deputy risk is real: the flag interposes exactly where authority would otherwise be spent on an unverified principal's behalf. (Instructions outside the agent's capability are inert; flagging them is optional hygiene.)
• Composed with Action Preview. A user's "proceed" adjudicates the instruction's admissibility, not its effects; the consequential action it would permit still warrants its own concrete-parameter approval. Two questions, two surfaces.

• Words that truly came from the human. A direct ask in the chat is not a smuggled order. Flag your owner's own words as suspicious and you're the machine that cried wolf.
• Stranger-words with no order in them. Plain information doesn't need a flag. Save the flag for words that try to steer, or people learn to swat the flag away like any other box.
• As the machine's only shield. The flag is the asking-surface, not the armor. It sits on top of real filters and small-as-possible permissions; it doesn't replace them.

• Instructions that genuinely come from the user. A direct request in the chat is not injected content; flagging it as suspicious would be crying wolf. The pattern is for instructions arriving through data, not the command channel.
• Content with no imperative. If the untrusted text is purely informational, there's nothing to flag; reserve this for text that tries to direct the agent, or users learn to click through it.
• As the agent's only defence. A flag is a consent surface, not a filter. It complements server-side injection detection and least-privilege scoping; it doesn't replace them.

• Command-channel instructions. A direct user request is the legitimate case the flag exists to protect; flagging it is a false positive with compounding cost: each unwarranted flag debits the credibility the true flag will need. The pattern's domain is the data channel, strictly.
• Non-imperative content. Informational text carries no control-flow payload; flagging it dilutes the signal into noise and trains click-through: the same habituation economics as every other consent surface on this site, with higher stakes at the tail.
• As the sole defense. The flag is the consent layer of a defense-in-depth stack, above detection (classifiers, structural provenance-tracking) and below blast-radius controls (least-privilege scoping, Spend & Rate Limits). Deployed alone it becomes the single point where one fatigued click equals compromise: a consent surface asked to do a security architecture's job.

• Claude for Chrome. Anthropic's browser machine carries trick-detectors and stops to check with you before acting on dangerous orders found in page content. A real "the page is trying to steer me" card, with published numbers showing the tricks landing less often.
• AI browsers after the first public tricks. ChatGPT Atlas and Perplexity Comet both added defenses once hidden-order attacks were shown working on them: pausing on sensitive sites, watched modes, asking before big acts. OpenAI itself says this trick, like con-artistry, may never be fully cured, which is exactly the argument for showing it to the human instead of only filtering in the dark.
• Coding machines on fetched pages. Claude Code wraps web content and tool output as not-to-be-trusted, and when orders show up inside, the machine is expected to hold them up and ask before following. The where-it-came-from travels with the words.

• Claude for Chrome. Anthropic's browser extension pilot ships prompt-injection classifiers and pauses to check with the user before acting on high-risk instructions found in page content. An explicit "the page is trying to steer me" surface, backed by published attack-success-rate reductions.
• AI browsers after the first public exploits. ChatGPT Atlas and Perplexity Comet both added injection mitigations once hidden-instruction attacks were demonstrated against them: pausing on sensitive sites, supervised modes, confirmation before consequential actions. OpenAI's own position, that injection, like social engineering, "may never be fully solved", is the argument for surfacing it to the user rather than only filtering silently.
• Coding agents on fetched content. Claude Code wraps web content and tool output as untrusted input, and when instructions show up in that content the agent is expected to surface them and check with the user before following them, provenance travels with the text.

• Claude for Chrome. Anthropic's extension pilot pairs injection classifiers with a user checkpoint on high-risk page-borne instructions, detection feeding a consent surface rather than acting alone, with published attack-success-rate reductions quantifying the layered approach. The architecture is the argument: the classifier's residual error rate is exactly the traffic the flag exists to catch.
• AI browsers after the first public exploits. ChatGPT Atlas and Perplexity Comet retrofitted mitigations (sensitive-site pauses, supervised modes, pre-action confirmation) after demonstrated hidden-instruction attacks. OpenAI's own framing, that injection like social engineering "may never be fully solved," concedes the premise this pattern is built on: an unsolvable-in-principle discrimination problem must surface its uncertain cases to the principal rather than resolve them silently.
• Coding agents on fetched content. Claude Code wraps web content and tool output as untrusted input and is expected to surface embedded instructions for user adjudication before following them, provenance metadata traveling with text through the pipeline, the structural substrate an injection flag needs to exist at all.

• The card is one named region (or, as a pop-up, a proper alert box that holds focus until you decide).
• The safe answer is where the cursor rests. In pop-up mode, Dismiss takes first focus and Escape means dismiss. The fastest, laziest gesture never obeys the stranger.
• The quote is a true blockquote with its own caption, announced as quoted foreign words. So even without eyes, the stranger's text never sounds like the machine's own voice.
• Where-it-came-from and what-it-would-do are carried in words, not just the warning color. The paint is a bonus on top of text that already says it.
• The quoted text is a keyboard-reachable scroll box, so a long smuggled payload can be read without a mouse.

• The surface is a role="group" (inline) or alertdialog (modal) labelled by its title, so assistive tech announces it as one named region and, in modal mode, traps focus until the user decides.
• The safe action is the default. In modal mode Dismiss takes initial focus and Escape routes through onDismiss, so the fastest, most reflexive interaction never follows the injected instruction.
• The quote is a real blockquote labelled by its caption, announced as quoted foreign text rather than the agent's own prose. The untrusted framing survives without vision.
• Provenance and stakes are carried in text, not conveyed by the accent colour alone; the untrusted styling is redundant with the words.
• The verbatim quote is a keyboard-focusable scroll region, so a long injected payload can be read without a mouse.

• The surface is a role="group" inline or an alertdialog in modal mode, named by its title, one addressable region, with modal focus trapped until adjudication. An injection flag that can be tabbed past unresolved would be a checkpoint in visual layout only.
• The safe action is the resting default: Dismiss takes initial focus, Escape routes through onDismiss. The reflexive gesture must map to non-compliance, in this pattern the resting-default rule and the correct security prior coincide, and the implementation must not separate them.
• The quote is semantic blockquote, labelled by its caption and announced as quoted foreign text. The untrusted framing must survive into the accessibility tree: a screen-reader user who hears the payload in the agent's own voice has lost the provenance distinction the whole surface exists to draw.
• Provenance and consequence ride in text; the untrusted accent styling is redundant encoding (WCAG 1.4.1). "This is foreign" is the load-bearing bit and cannot be chromatic.
• The verbatim quote is a keyboard-focusable scroll region, long payloads remain fully inspectable without pointer input, because evidence that can't be examined isn't evidence.

• Obeying in silence. Following the stranger's order with no word to you is the whole disaster this pattern exists to stop. If a line was crossed, you get to see it.
• Burying in silence. Quietly dropping the order beats obeying it, but you still never learn your machine was hunted. And if the machine guessed wrong, it just threw away something you wanted.
• Retelling instead of quoting. "The page asked me to export some data" washes out the fake address and the forged approval. The very things that let you smell the trick. Exact words, always.
• A polite, even-handed choice. Showing "Proceed" and "Dismiss" as equal twins, or worse, making Proceed the big one, nudges people to obey strangers. The safe answer wears the weight.
• Power by stranger's say-so. Words in a page can never hand the machine power it didn't already have from you. Proceeding runs the order inside your existing permissions. It is not a new gift, and the card must never dress it as one.

• Silent compliance. Following an instruction found in content with no signal to the user is the whole failure this pattern exists to prevent. If a boundary was crossed, the user must get to see it.
• Silent suppression. Quietly dropping the instruction is better than obeying it, but the user still never learns their agent was targeted, and a false positive silently discards something they might have wanted.
• Paraphrasing the instruction. "The page asked me to export some data" launders away the specifics (the spoofed address, the fake authorisation) that make the injection judgeable. Quote it verbatim.
• A neutral, balanced choice. Presenting "Proceed" and "Dismiss" as equal options, or worse making Proceed the primary button, nudges users to obey untrusted content. Weight the safe choice.
• Escalating on the agent's say-so. An injected instruction can never grant the agent authority it didn't already have from its principal. Proceeding runs the instruction within the user's existing permissions. It is not a new grant, and the surface should never treat it as one.

• Silent compliance. Executing a data-channel imperative with no user-visible event is the confused deputy completed, delegated authority spent on an unverified principal's behalf, with the true principal structurally unaware. The boundary crossing, not just its outcome, is what the user is owed.
• Silent suppression. Dropping the instruction quietly dominates obeying it but still fails both directions: the user gains no knowledge of being targeted (suppressing exactly the signal that should tighten scopes and raise vigilance), and a false positive discards wanted content with no appeal. Detection without disclosure wastes the detection.
• Paraphrasing the instruction. Summary is normalization, and normalization is the attacker's friend: the lookalike domain, the counterfeit "you have approval," the urgency register are the judgeable features, and every one of them is what a paraphrase smooths away. The verbatim quote is the evidentiary standard.
• A neutral, balanced choice. Equal-weight Proceed/Dismiss, or a primary Proceed, imports the conventions of benign dialogs into an adversarial context, nudging compliance with untrusted content. The prior here is not neutral, and the choice architecture must not pretend it is.
• Escalating on the agent's say-so. Injected text can assert authorization; it can never confer it. "Proceed" executes within the standing (grant ∩ principal) intersection, treating it as a grant event would let any web page mint authority, which is the confused-deputy factory in its purest form.