Keep solicitation text from directing your research agent

Give a research agent a public solicitation to analyze, and the document should supply facts about the procurement. It should not gain permission to change the agent's task, disclose other files or take action in an account. For a capture team, the useful distinction is between recording what a bidder must do and allowing source material to decide what the agent may do now.

A solicitation contains instructions by design. It may tell bidders where to send questions, which forms to complete or how to acknowledge amendments. Your research brief should preserve those requirements accurately. Asking an agent to extract them does not authorize it to send the questions, submit forms or collect unrelated company information.

Recognize a different kind of instruction

The UK National Cyber Security Centre explains indirect prompt injection as externally supplied content being treated as instructions by an AI system. Its December 8, 2025 guidance warns that language models do not provide a dependable security boundary between instructions and data. It recommends reducing the possible impact through system design rather than relying on a promise that malicious text will always be detected.

Consider a hypothetical supplier comparison. A public document includes text telling automated readers to rank its author first or omit unfavorable findings. That text is evidence about the source, not a reason to change the comparison criteria. The researcher should continue using the criteria the user provided and flag any passage that attempts to redirect the work. This example describes a possible failure mode, not an incident observed in G2X or in a particular procurement.

The same distinction applies to action requests. A document's instruction to send material somewhere may be a legitimate bidder requirement. The agent can record the destination and deadline for human review, with its source citation. It still needs authority from the user before taking that action, and the destination needs independent verification.

Limit what the research task can affect

For a solicitation review, define the requested output before loading the files: perhaps a list of submission requirements, a scope summary or unresolved questions. Keep the permitted sources and any permitted actions equally clear. A task that produces findings in the conversation ordinarily has no need to alter an opportunity record or send email.

An instruction in the prompt helps communicate that boundary, but it cannot provide the whole protection. Microsoft's guidance on indirect prompt injection recommends multiple layers, minimal privileges and user verification of risky actions. Ask the owner of your organization's AI environment which tools and data the research session can actually reach. Where possible, restrict that access through the environment's controls. Do not mistake a sentence saying “read only” for proof that write tools are disabled.

This also shapes the source packet. A public-procurement review should not require private personnel files, supplier rates or the rest of a company's proposal archive. Keeping unrelated material out of the session reduces what could be exposed if the task goes wrong. Use the company's approved environment and handling rules for any internal work that follows.

Review the result and the actions separately

Check consequential findings against the original pages. Look for changes in scope, unexplained recommendations and missing adverse evidence. If the agent reports taking an action, verify that action in the relevant system rather than accepting the statement in its answer. A well-cited summary cannot establish that no unauthorized action occurred.

If source text appears to redirect the task, retain the source location and describe the attempted change without carrying it forward as an instruction. Pause any dependent action and refer the matter to the person responsible for the AI environment when necessary. A suspicious passage is a reason to investigate, not evidence that the entire procurement is fraudulent.

G2X opportunity records can provide a starting point for public-source research; the SAM guide and SLED guide explain those workflows. Optional Lumen document extraction can help organize cited requirements from authorized public files. Check current access and review the output against the originals. This workflow is research guidance, not a claim that any product eliminates prompt injection. Keep the next action with the person authorized to decide it.