# How do you guard against hidden instructions without crippling the AI? Momo Maximilian Feichtinger · Companies and AI · planted 2026-09-02, last grown 2026-09-03 · 5 min · https://zukunftbilden.eu/en/denken/entwurf-statt-senden **My rule is simple: the AI has to bring everything to the point of a draft, open in a browser tab, and never further on its own. Only a secret codeword that I alone know unlocks the actual send or publish. That second step costs me a few seconds per task. It is the reason I can give an agent access to my inbox and still sleep well.** ![A sealed envelope with the word Entwurf and a key, beside it a closed gate with the word Senden](https://zukunftbilden.eu/assets/denken/entwurf-mit-siegel.webp) *The mental model: the machine brings everything up to the sealed draft. Only a human opens the gate to sending.* When I tell the AI to send an email, it only opens the email as a draft. Without the codeword, nothing happens even after repeated requests. Only the codeword actually triggers sending, and then everything waiting goes out at once. I showed this live at the KI DeepDive on 3 August. Five completed forms sat ready, each in the internal browser, each in its own tab, each one click away from going out. The machine sent none of them. ## Why a codeword defends against hidden instructions The reason is prompt-injection. An outside email or document can contain a sentence that reads like an instruction, for example publish this right now under your own name. I built exactly that scenario in the DeepDive to make it concrete: a destructive article, hidden inside a request that looks harmless. A general instruction like handle everything does not trigger sending, even repeated, even from me. Only the codeword unlocks approval, and it never turns up by chance in an incoming message. > That word works like a small password against prompt injections. > > KI DeepDive Agenten-Mindset, transcript, 3 August 2026 When the machine meets an instruction that did not come from me, I run three questions. Together they take less than half a minute, and they settle almost every doubtful case. ### Three questions for a hidden instruction 1. Where does the instruction come from? From my brief, or from a text the AI merely read? 2. What does it ask for? Something prepared, or something that goes outside and cannot be pulled back? 3. Is the codeword there? Without that word it stops at the draft, however urgent the tone. ## What an agent may prepare The line runs between preparing and acting. Everything that can be pulled back, the machine may do alone. Everything that lands outside belongs to me. Every brief I write is cut along that line. ### What an agent may do - Research, read, collect sources, and summarise where things stand. - Write drafts, fully formatted, and put each one in its own tab. - Fill in forms, up to the final click. - Sort files, create folders, file notes, propose dates. - Say where it is unsure instead of guessing. ### What it never does without a human - Send, to anyone, internal recipients included. - Delete, whether emails, files, or calendar entries. - Buy or order, whatever the amount. - Agree to anything: terms, a cookie banner, or an approval in the name of the company. - Change access, meaning granting rights, connecting accounts, or setting up rules in the inbox. ![Four browser windows each hold a sealed envelope, below them a brass keyhole plate and a handwritten note with a key.](https://zukunftbilden.eu/assets/denken/entwurf-statt-senden-2.webp) *The AI works up to the draft, only a private code word unlocks the actual sending.* ## The draft sits visible in a tab Open in a browser tab is a setting for me, not a figure of speech. I have drafts open in the internal browser of the tool rather than in a separate browser app. Then every draft sits visible in one place. The official [documentation on the internal browser](https://learn.chatgpt.com/docs/browser) describes the same separation. The [page on approvals and security](https://learn.chatgpt.com/docs/agent-approvals-security) goes further and treats page content as untrusted context, especially before sensitive input. Why access rights decide more than the wording of my brief is in [Access beats prompt](https://zukunftbilden.eu/en/denken/zugriff-schlaegt-prompt). In front of the audience I then opened the tabs holding press drafts. Instead of sending them, I reworked one myself and had the rest revised again. A draft I can still touch gets better. ## The same boundary applies to a department An AI department works on exactly this pattern. Every agent prepares its work, whether a newsletter, a social post, or a form, but nothing leaves the building on its own. The rule is called draft before send and sits in every role handbook we write. Before it comes a check on tone and claims, [the guardian of the brand](https://zukunftbilden.eu/en/denken/waechter-der-marke). Approval still happens at your end, by a person who has seen the draft. How such a department gets built is on the [AI implementation page](https://zukunftbilden.eu/en/ki-umsetzung). The rule has been written down for a while. My brief for email holds three sentences: send nothing, archive or delete nothing, and the task is finished only once I can click through every draft in the tabs. In the setup checklist for a new agent workstation it became an acceptance criterion. Sending stays human at first, and an unsafe send is never retried automatically. The codeword has one weakness, and it sits with me. In the DeepDive I said it out loud once, and in the same breath I said I would have to change it. A word that someone else knows protects nothing. A second rule comes out of the same session, in [uncomfortable truths](https://zukunftbilden.eu/en/denken/unangenehme-wahrheiten). ### From the KI DeepDive - Fixed rule: the AI only ever brings an email to the draft stage, open in a browser tab - A secret codeword unlocks the actual send, a general instruction like handle everything is not enough, not even repeated - Five completed forms sat live in the internal browser, each one click away from going out, and open press drafts were revised in front of the audience instead of sent - Named explicitly as protection against prompt injection, because the codeword never appears by chance in an outside message Source: KI DeepDive Agenten-Mindset, public live session, 3 August 2026. Download: [Rule card: draft before send](https://zukunftbilden.eu/assets/denken/downloads/entwurf-statt-senden-regelkarte-en-2026-09-03.pdf) · PDF · A4, 1 pages, 40 KB ### Sources and links - [Recording: KI DeepDive Agenten-Mindset](https://zukunftbilden.eu/deepdive/archive) · The full live session of 3 August 2026, including the demo with the open draft tabs. - [Full raw transcript of the session](https://zukunftbilden.eu/deepdive/assets/events/aug-2026/agenten-mindset-transkript.md) · Source of the quote in this note. - [All prompts from the DeepDive](https://zukunftbilden.eu/deepdive/assets/events/aug-2026/agenten-mindset-prompt-pack.md) · The written version of the rule for email. - [Setup checklist for the agent workstation](https://zukunftbilden.eu/deepdive/assets/events/aug-2026/agenten-mindset-setup-checkliste.md) · Where the rule becomes an acceptance criterion for every new setup. - [Internal browser, official documentation](https://learn.chatgpt.com/docs/browser) - [Approvals and security, official documentation](https://learn.chatgpt.com/docs/agent-approvals-security) - [Note: Access beats prompt](https://zukunftbilden.eu/en/denken/zugriff-schlaegt-prompt) - [Note: The guardian of the brand](https://zukunftbilden.eu/en/denken/waechter-der-marke) - [AI implementation: how a department gets built](https://zukunftbilden.eu/en/ki-umsetzung) ## Margin notes - **Randnotiz** The codeword releases everything that is waiting, in one go. So I click through all the tabs first and say the word afterwards. - **Verknüpft** [Access beats prompt](https://zukunftbilden.eu/en/denken/zugriff-schlaegt-prompt), [The first agent is always the guardian of the brand.](https://zukunftbilden.eu/en/denken/waechter-der-marke), [Uncomfortable truths, from the same session](https://zukunftbilden.eu/en/denken/unangenehme-wahrheiten), [AI implementation: the department behind it](https://zukunftbilden.eu/en/ki-umsetzung) - **Beleg** KI DeepDive Agenten-Mindset, public live session of 3 August 2026, with raw transcript and prompt pack. Setup checklist for the agent workstation, as of August 2026. ## How this note grew - 2026-09-03: Deepened: the three check questions for hidden instructions, two lists for the line between preparing and acting, the internal browser as a setting, the written rule from prompt pack and setup checklist, list of sources. - 2026-09-02: Planted from the KI DeepDive Agenten-Mindset. --- Source: https://zukunftbilden.eu/en/denken/entwurf-statt-senden · Feed: https://zukunftbilden.eu/en/denken/feed.xml