October 2026
Taint only what looks injected: a small classifier that gives an agent its work back
No AgentDojo injection succeeded against my agent gateway, whose taint rule refuses all writes after the agent reads third-party content; that rule also blocked most of the user's own tasks. I trained a ModernBERT detector for injected instructions in tool output and let it decide what gets tainted. Benign task success went from 32 to 70 of 97, and attack success stayed at 0 of 200.