Ahmadreza SamadiThe document tried to become the boss
A fictional theatre shows why reading a document should not let it take over an AI assistant. A smaller tool set, checks on incoming content and human approval points can limit the damage from a misleading instruction.
English animated explainer with synthetic narration and English captions. Asha, the theatre, supplier documents and hidden note are fictional teaching devices. The gates illustrate our practical checklist, not a real security deployment or a proven prevention system. No usable attack instructions are shown and no Anthropic affiliation is claimed.
Read the English film transcript
Asha runs a small records office. She asks her AI assistant to summarise three supplier documents. One of them carries a hidden note that has nothing to do with the summary. It tries to send the assistant somewhere else entirely. That’s a prompt injection: instructions
hidden in the content an AI processes, trying to steer what it does. Anthropic’s research on browser agents says no browser agent is immune to prompt injection. And it describes several defences, not just one. On the developer’s side, they describe training the model to
refuse such instructions, classifiers that scan untrusted content, and expert red teams that test the system. Red teaming is testing by the developer. It doesn’t mean a person reviews every action an assistant takes for you. So in our fictional theatre, the note has to
get past more than one gate, and each gate has a different job. First, a smaller key. The assistant only gets the tools this task needs. A summary doesn’t need the payment desk or your outbox. Second, in our fictional theatre, a screen for untrusted
content. Notes that come from documents are meant to be flagged, and kept away from the director’s chair. Third, a real checkpoint. Anything consequential, like sending, paying or deleting, waits for a person who checks it. Each of these controls can fail. Together, they shrink
what one bad note can reach. That’s less risk, not zero risk. Before you connect an assistant to your work, ask three things. What can it reach? What screens the content it reads? And which actions wait for your approval? Ahmadreza Samadi. More at a-samadi.com