The Document Is Untrusted Content

Every document an agent reads is a message from a stranger. A police report, a medical record, a repair estimate: each one arrives from outside the building, written by hands the company does not control, and each one can carry a second text hidden inside the first — an instruction addressed to the agent rather than to any human reader. The security model presented at Guidewire Connections 2026 starts from that plain fact and refuses to soften the wording: the document is untrusted content.

The setting matters because claims work is ordinary work. Nothing about the scenario requires an exotic attacker or a futuristic system. A working claims agent, doing exactly the job a carrier asked for, opens files that customers supplied — and the session reported from Las Vegas argues that the industry should design for the day one of those files talks back.

01 · The session

At Guidewire Connections 2026 in Las Vegas, Viyat Bhalodia — a member of technical staff at OpenAI who leads security work for agentic products — spoke with Ben Chang, a Guidewire engineering vice-president, about putting claims agents into production. The exchange was reported on October 30, 2026 by Insurance Innovation Reporter and summarised on October 31 by Pivot News. The framing case is ordinary and uncomfortable: a claims agent reads a police report, medical records or a repair estimate supplied by a customer, and somewhere inside the document sits a hidden instruction, written for the agent rather than for any human reader.

02 · The lethal trifecta

The session named the dangerous combination directly: sensitive data, untrusted content and external network access — a trio described as the lethal trifecta. Claims handling assembles all three by default. The files are sensitive by nature; the documents arrive from outside the company's control; and a useful agent needs to reach systems beyond its own sandbox to do the job. Any one element alone is manageable. Together, the three form the path an injected instruction needs: read the secret, obey the stranger, send the result somewhere.

The closing assignment for attendees was an audit — find every agent in the building where the three already meet. The audit is worth doing precisely because the trifecta rarely announces itself. Each element looks innocent in isolation: a file store here, a document reader there, a network call added to make the agent useful. Risk lives in the combination, and combinations are exactly what architecture reviews tend to miss.

Together, the three form the path an injected instruction needs: read the secret, obey the stranger, send the result somewhere.

03 · Design for the failure

The premise underneath the controls deserves emphasis: assume prompt injection sometimes succeeds. Models are trained to resist injected instructions, and the resistance keeps improving — and the professional posture, as presented in the session, is to refuse to rest the whole defence on that single layer of software. A model that can be talked into an action must be surrounded by machinery that decides what actions exist at all. Security moves from persuading the model to behave, toward bounding what misbehaviour could accomplish on the worst day.

Designing for failure is an old engineering habit arriving in a new field. Bridges assume loads beyond the forecast; aircraft assume an engine quits; and agent systems, under this model, assume a persuasive paragraph lands exactly where the model can read it. The shift sounds pessimistic and is actually liberating: once failure is admitted, engineering can start, because controls can be tested against a stated threat instead of against optimism.

04 · The layered controls

The controls named are deterministic, and deliberately unglamorous. A sandbox limits which files an agent can open and which network destinations an agent can reach. Least privilege grants access to what the task needs and nothing beyond that access, with credentials that expire instead of the long-lived keys common in existing infrastructure. And an auto-review pattern puts a second agent on duty: proposed actions are evaluated against the user's actual request and the task context, so an instruction smuggled inside an untrusted file — send these documents to a third party, say — gets flagged against the job the agent was genuinely given. Layered, the controls fail independently; an attacker must defeat all of them, in sequence, inside one session.

Each layer also answers a different question, which is why the layering holds. The sandbox answers where an agent may go. Least privilege answers what an agent may hold. Expiring credentials answer how long a stolen key stays useful. The reviewing agent answers whether a proposed action matches the job a person actually requested. A control that answers one question cleanly can be audited, replaced and improved without disturbing the others.

05 · What to watch

Cybersecurity for agents is becoming a design discipline rather than a review step, and the trifecta gives teams a shared vocabulary for the audit. The pattern matches the standing practice at Ovia: context engineering decides what enters an agent's world, and the security model decides what an agent can touch once inside — least privilege, short-lived credentials, sandboxed tools, observable state. Watch for the trifecta audit becoming a standard gate before production launches, and for second-agent review moving from a named technique into default platform behaviour.

The pattern also reframes procurement. Buyers evaluating a claims agent, a support agent or any agent that reads outside material now have three plain questions to ask any vendor: where does untrusted content enter, what can the agent reach while holding sensitive data, and which deterministic control breaks the chain when an instruction slips through? Vendors with layered answers — sandbox boundaries, expiring credentials, independent review of proposed actions — are describing architecture. Vendors with only model-behaviour answers are describing hope, and the session's whole point is that hope is not a control.

The honest caveats belong on the record. Layered controls cost latency, engineering time and operational attention, and a second reviewing agent adds a second system to secure. None of that argues against the model; the argument runs the other way. Documents will keep arriving from strangers, agents will keep reading them, and the teams that treat every page as untrusted content — politely, structurally, by default — are the teams whose agents can be trusted with the next document, and the one after that.