The agent should not choose its own state view

Short summary

An in-depth analysis of why AI agents should not freely choose what they read from their environment. Uncontrolled reads expose agents to prompt injection through task data that reads like instructions. The author introduces the concept of a state view — a record of which sources were read, which fields returned, which version, and under whose permission — as a narrower control than sandboxing. The key insight: an allowed read is not a safe read.

• •Agents that freely decide what to pull into context are vulnerable to prompt injection via any text they encounter
• •A state view records what the agent was actually shown: source, fields, version, and authorizing permission
• •Sandboxing limits reachability but does not control observation; state views fill that gap

Generated with AI, which can make mistakes.