Dual-model separation

Dual-model separation

For agents handling untrusted content, one more pattern is worth knowing.

Split the work between a privileged model that sees sensitive data and can call tools, and an unprivileged model that processes untrusted external content and cannot. The untrusted content never reaches the model holding the capabilities, so an injection in a scraped web page or an inbound email cannot directly drive a tool call.

It costs an extra call and a more complex orchestration. For an agent that reads inbound email and takes action, it is the difference between a design that can be hijacked by anyone who can send you a message and one that cannot.

The output door, again

Chapter 13 built the markdown image filter. It belongs here too, because retrieval and agents are what make it exploitable.

EchoLeak, CVE-2025-32711, is the worked example. A crafted email reached Microsoft 365 Copilot's context through ordinary ingestion. Reference-style markdown slipped past link redaction. Auto-fetched images carried data out. Zero clicks. Microsoft patched it server-side in June 2025 and reported no exploitation in the wild, so treat it as a proven technique rather than an open hole.

Every element was a normal feature. Ingest email so the assistant is useful. Render markdown so answers look good. Fetch images so they display. The vulnerability lived in the combination, which is why a control on any single component would have missed it, and why the output filter belongs at the gateway where it sees the assembled result.

If your application renders model output and your model reads content you did not author, you have this shape. Allowlist the hosts your renderer will fetch from, and treat every URL in a completion as attacker-controlled until proven otherwise.

What to do first

The first two are afternoons and they close the highest-volume failure in most RAG applications. Start there.

Four doors are shut. The fifth is the widest, the cheapest to close, and the one almost nobody has looked at.

Sources for this chapter

• Embedding inversion recovering 50–70% of original input words — arXiv 2406.10280: https://arxiv.org/pdf/2406.10280
• OWASP Top 10 for LLM Applications: vector and embedding weaknesses, LLM08:2025 / LLM09:2026 — https://genai.owasp.org/initiatives/top-10-for-llm-and-genai/ · 2025 PDF: https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf
• Cross-context retrieval in inadequately partitioned multi-tenant vector stores — https://www.protecto.ai/blog/how-rag-systems-sliently-expose-pii/ · https://christian-schneider.net/blog/rag-security-forgotten-attack-surface/ · Both practitioner or vendor sources.
• Prompt injection leaking personal data observed by agents during ordinary task execution — arXiv 2506.01055: https://arxiv.org/pdf/2506.01055
• Data exfiltration via backdoored tool use — arXiv 2604.05432: https://arxiv.org/pdf/2604.05432
• Guardrail classifiers reduce malicious-prompt success materially but not completely — stated qualitatively on purpose. A ">90%" figure circulates widely in secondary reporting; the primary result could not be located, so the number is not quoted in the text.
• EchoLeak, CVE-2025-32711 — arXiv 2509.10540: https://arxiv.org/abs/2509.10540 · Disclosed by Aim Security June 2025, CVSS 9.3, patched server-side June 2025, no exploitation in the wild.
• Capability-based agent design and dual-model separation — mitigation directions named across the agent-security literature above.

The deletion and provenance guidance, the argument for filtering inside the search rather than after it, and the priority table at the end are the author's engineering positions.