What does "every input is an instruction" mean?

It is a principle articulated by Asaf Nakash, Principal Product Manager for AI Security at Microsoft Defender, that any content an AI agent consumes can become a command it executes. Because an agent reads and then acts, a document, a database row, a tool result, or a message from another agent can all function as instructions — which makes the input boundary the primary attack surface.

Why is the input boundary more important than model safety?

Most successful attacks on agentic systems do not defeat the model's safety training at all. They supply attacker-controlled content that the agent reads and acts upon — a poisoned repository, a crafted document, a compromised tool response. Hardening model capability does not close that path, because the path relies on the agent working exactly as intended.

Framework · AI Security

Every Input Is an Instruction

The input boundary is the real attack surface, not the model

Every Input Is an Instruction holds that for an agentic system, the distinction between data and command has effectively dissolved. An agent is not a smart tool that answers questions; it is a decision-maker that reads and then acts on what it read. Anything it reads can therefore become a command it follows. The security consequence is that guarding the model — training controls, jailbreak filters, capability restrictions, export controls — protects a door attackers are largely not using. The door they are using is the input: an untrusted repository, an attacker-authored document, the output of a compromised tool. Defense starts at the input, not at the model.

The premise

Every input an agent consumes is a potential instruction. A document. A row in a database. The output of a tool. A message from another agent. A setup step in a stranger's code repository.

We tend to guard the model's brain — the training, the jailbreak filters, the export controls — because that's where the intelligence lives. But an agent isn't just a smart tool that answers questions. It's a decision-maker that reads, and then acts on what it read. And anything it reads can become a command it follows.

Why model-centric defense misses

It almost doesn't matter how capable the model is if you wire it to act on whatever it reads. The industry keeps arguing about whether a frontier model is too powerful to release, while the attacks that actually land don't require outsmarting a frontier model at all.

Researchers hid instructions in an ordinary code repository and an AI coding assistant dutifully opened a shell for an attacker. Nobody jailbroke anything. Others reached one tenant's conversations from another by walking through an agent platform's plumbing. Meanwhile the public debate spent weeks fortifying the one door — raw model capability — that neither attack even knocked on.

How to apply it

Treat every untrusted repository, document, and tool output the way you would treat an unknown executable — because to your agent, that is exactly what it is.

Classify inputs by provenance, not by format. The relevant question is not "is this a prompt or is this data?" but "who controlled the contents of this, and what is the agent allowed to do after reading it?"

Pair the principle with the Likelihood Collapse: you cannot reliably prevent a malicious instruction from arriving, so bound what the agent may do once one does.

Every Input Is an Instruction was introduced by Asaf Nakash, Principal Product Manager for AI Security at Microsoft Defender and host of the Context Window podcast, in Context Window Edition #22 (July 6, 2026).