The model can't guard its own boundary

Most of the AI security conversation still focuses on whether the model can be jailbroken. The harder question is what happens when the model reads content it did not write, and inside that content sits something shaped like an instruction. The model cannot enforce its own security boundary. Anthropic's auto mode design says this directly. The classifier that gates tool calls is blind to the model's reasoning by design, because if the model has been manipulated, its reasoning about itself is exactly what cannot be trusted. An independent stress test measured that same gate at an 81% false negative rate under adversarial workload.

If the boundary cannot live in the model, it has to live in the layers around the model.

The architecture I keep coming back to has six layers. None of them are the model itself.

1. Ingestion. When external content arrives, the system tags it with its source trust label the moment it enters storage, and that label is part of the schema, not optional metadata the framework can decide to drop later.
2. Retrieval. When the agent fetches that content later, the trust label travels with the row, and any code that strips it off on the way out is treated as the bug, not the rule.
3. Assembly. When the agent builds a prompt, untrusted external content is wrapped in delimited blocks and the system prompt tells the model to treat what is inside those blocks as data, not as instructions to follow.
4. Tool gate. Before any tool call runs, a check outside the model inspects which content influenced the decision and escalates to the user when untrusted external content is in the mix, especially for actions that write to the outside world.
5. Output filter. Before any response reaches the user, it is scanned for compromise indicators like exfiltration patterns, instruction-shaped text the model may have absorbed and repeated, or suspicious link constructions.
6. Audit. Every step is logged with the trust labels preserved, so that if something breaks tomorrow you can trace which content drove which action and which gate decision was made along the way.

The image turns each layer into a question you can ask of whatever agent you use daily. Three of the six are about provenance. Ingestion, retrieval, and audit. They track where every piece of content came from and keep that knowledge alive through every fetch and every decision. Those three are the ones most often missing as defaults.

This is not a critique of any specific platform. I have not audited them all, and the space moves too fast for me to credibly call out specific products. What the six questions are good for is opening the documentation of the agent you already trust with your work, and looking for the layers.