Ahmadreza SamadiThe document tried to become the boss
A fictional theatre shows why reading a document should not let it take over an AI assistant. A smaller tool set, checks on incoming content and human approval points can limit the damage from a misleading instruction.
English animated explainer with synthetic narration and English captions. Asha, the theatre, supplier documents and hidden note are fictional teaching devices. The gates illustrate our practical checklist, not a real security deployment or a proven prevention system. No usable attack instructions are shown and no Anthropic affiliation is claimed.
The situation
Asha asks an assistant to summarise three supplier documents. A hidden note tries to climb into the director’s chair. The theatre is an analogy: the supplier’s document is material for the task, while the user’s request defines what the assistant should do.
What the source supports
Anthropic’s research, published on 24 November 2025 and checked on 22 October 2026, describes prompt injection as hostile instructions within material an AI processes. It discusses model training, screening classifiers and expert red teaming, while stating that browser agents remain vulnerable. Red teaming tests the system; it is not a person approving each user action. [APID]
Three practical questions
Our original checklist asks: which tools can the assistant reach, what checks apply to incoming documents, and which consequential actions wait for a person? In the fictional theatre these become a smaller key ring, a screen for outside notes and a checkpoint before sending, paying or deleting. Make the approval describe the actual action and its destination.
Limits
These are layered precautions, not a guarantee. The theatre, supplier papers, assistant and hidden note are fictional; no real attack or usable payload appears. The checklist is our practical interpretation, not a tested product or a measured security outcome. The film does not claim immunity, attack rates or affiliation with Anthropic.
About the author
Ahmadreza Samadi — https://a-samadi.com