Repair Prompt Injection, Instruction & Tool Boundary Gaps

The likely issue is a contract mismatch around prompt injection, untrusted instructions, retrieved/web content, tool authorization, system/developer policy separation, data exfiltration paths, output handling, approval gates, and adversarial evaluation. I would first define the invariant: Untrusted content may influence task data but cannot change application authority, tool permissions, approval requirements, secret access, or destination policy; those controls must be enforced outside the model wherever possible. Then I would trace the smallest owning boundary, apply or propose a bounded repair/review step, and add deterministic normal, boundary, failure and replay tests. The workflow preserves existing authorization, safety/security policy, data-access boundaries, user approvals, privacy, and tool-side enforcement. If repository/workspace files are available, the findings can be mapped to exact paths and focused local validation; with partial evidence, the result stays an explicit diagnosis/evidence map with assumptions and no invented execution claims.