Agents that act on email and files can be hijacked by hidden instructions in web pages or shared documents. This is .
SPILLWAY does not let the large language model (LLM) alone decide whether a call is safe. It trusts only structured fields that identify senders, accounts, or files; injected instructions arrive as free text, so targets not named by the user or returned by a trusted tool are blocked. Instruction-like text is removed before the LLM reads it.
No standard templated injection redirected an action, and a stronger learned attacker succeeded on average .007 of the time, while utility stayed high. The check adds almost no model calls, so it can protect personal agents without slowing them down.