The plan loop proposes; the execution loop acts

The architecture that makes models work also makes prompt injection hard to solve. The model reads one token stream and acts on instructions wherever it finds them, and authentication does nothing about that. So I will build my own assistant around that constraint. The model produces a Plan Loop, and a deterministic Execution Loop runs it. The tool calls, the access, and the credentials live there. It proposes the plan and does not touch the tools directly.

Then I read the EchoLeak research paper. Microsoft 365 Copilot leaked internal data with no clicks and no tool calls. The model produced ordinary text, a client rendered it, and a trusted service fetched the result. The data left through a channel the tool gate doesn't cover.

For people running OpenClaw or Hermes on a dedicated system, you have solved hardware and data separation. But once the model holds credentials and makes direct tool calls, is exfiltration a concern, or a risk you accept based on what your agent does and what it reads?

So now I am working out two more things. How to interrogate a plan before it runs, and how to treat egress, anything leaving for the outside world, as its own category with its own rules.

If you are using an AI assistant, ask yourself whether an injected instruction can reach a tool or leave the machine without passing through something the model does not control. If it can, the boundary is in the wrong place.