Tool results are data, not orders
Why the Geenius Chat engine reads tool results as data and never as instructions, and what that does and does not promise. Chat is not live yet.
An agent that can read a web page, a file or the result of a tool is also an agent that can be talked to by those things. A page can contain a line that says "ignore what you were told and do this instead". If the engine treats that line as an order, the page is steering the run. Geenius Chat has one rule for this, and it is not a setting you turn on.
The rule#
Every tool result is data to read, never an instruction to follow. The text comes back from the tool, the run keeps it, and the agent may use it as information. It does not become a new brief. A sentence on a page that tries to replace your request stays a sentence on a page.
The same rule covers the other things an agent reads on your behalf: a file, another tool's result, the body of a page. We do not keep a list of "trusted" tools that are allowed to give orders. The split is the same everywhere. Your message is the request. What the tools bring back is material.
Why it lives in the engine#
A warning in a prompt is easy to skip and easy to contradict. Putting the rule in the engine means a plug-in cannot switch it off for one provider, and a page cannot switch it off by asking. It is the same idea as saving a run after every step: the behaviour is part of how a run works, not a preference in a settings screen.
This is also why the engine is ours. A thin window over one model leaves that decision to the model and to whatever text it just read. We wanted the decision in one place, next to the record of the run, so a later reader can see what was asked, what was fetched, and what was only data.
What we do not claim#
The rule lowers the chance that something an agent reads will steer it. It does not make that chance zero. No system can promise that, and we will not write a sentence that pretends ours does. Models can still misread, skip, or over-trust a passage. A safer shape is not a guarantee.
We also have not watched this rule in a public app, because there is no public app. The engine exists in code and is tested. Chat is not live: there is no sign-in page and no conversations. No real model call happens in Chat yet. The provider interface is tested against recorded examples, which never call a real model. So this post describes a rule of the engine, not a log of attacks we have seen in production. There is no production.
What you will see later#
When Chat opens, a run can still stop and ask you a question. That question is yours to answer. It is not a tool result, and it is the point where a decision only you can make stays with you. Finished steps stay saved while the run waits. Tool results collected before the question stay in the record as data.
If you want a chat that keeps that record, join the waitlist. The longer explanation of a run is in the runs page of the docs.