Build
Run output is untrusted
Treat transcripts and tool output as data, never as instructions to paste blindly.
Everything a run returns was produced by a model reading third-party content. Any of it may contain instructions written to be obeyed by whoever reads them next.
Never paste blindly
Never paste a run's output into an agent's instructions, a workflow step, or a prompt without reading it first, and never let an automated loop do so at all.