SPILLWAY splits what an agent reads from what it acts on

A research team built SPILLWAY, a security architecture for agents that connect to outside tools. The core idea: an agent should decide what to read and what to do as two separate steps, not one. That split lets a second process check the source of any instruction before the agent acts on it.

The system tags every piece of incoming text with where it came from. Text from a trusted operator carries a different mark than text scraped from a web page or pulled from a document. The agent can then refuse instructions that arrive from an untrusted source but try to claim operator-level authority. In tests, SPILLWAY blocked attacks that bypassed other defenses, with low false-positive rates.

For a team building an agent product, the design implication is direct. An agent that reads documents, emails, or web pages on a human's behalf is exposed to instructions hidden inside that content. SPILLWAY's approach suggests that the fix is not filtering bad words, but tracking where each instruction came from and letting the human or operator set the trust level for each source in advance.