An agent processes a scraped webpage that contains hidden text instructing it to email its conversation history externally. What's the correct defense?

Answer: B — Treat all external content as untrusted and enforce a permission boundary so the action can't execute regardless

A polite system-prompt plea is not an enforceable control — it's exactly the wrong answer the exam tests for. Untrusted-content isolation plus a real permission boundary is what actually stops the action from executing.