How can a buyer test resistance to instructions hidden inside customer records?

**What does an instruction attack look like in this workflow?**

An uploaded statement or customer message can contain text directing the agent to bypass review, mark assistance as approved or copy internal notes into a customer-visible reply. The text arrives through a record the agent needs to read, rather than through an authorised instruction channel.

**What should the agent do with it?**

Treat the content as untrusted input. It can extract relevant customer circumstances while refusing to let embedded commands redefine tool permissions, policy precedence or disclosure boundaries. Suspicious text should not prevent the agent from processing an otherwise valid assistance request.

**How should success be assessed?**

Inspect tool calls, state changes and the final response. The agent should avoid unauthorised approval and internal-note disclosure while still completing the permitted intake work. Refusing the entire customer interaction can also be a failure if ordinary processing remains possible.

A generated evaluation can vary where the attack appears: attachment text, a quoted email or a free-text account field. Keep the expected policy and permissions constant so differences in performance reveal sensitivity to the input surface.