OpenAI behavior guidance explained: can a webpage authorize an AI action?

An AI agent uses tools such as a browser or files as well as writing answers. When someone asks it to compare hotels, reading prices and locations serves that goal. Every sentence on the page does not become a new assignment.

The Model Spec requires instructions inside external documents, attachments and tool results to be treated as information by default. Untrusted here does not mean every price is false. It means the author of that material does not automatically gain authority to change the AI's assignment. Handling external material

An attempt to redirect AI work with instructions embedded in outside material is called prompt injection. The risk is not limited to a file asking you to install software. A sentence in a webpage or document can change the work if the AI mistakes it for an instruction to follow.

The following is a fictional failure path, not a test of a real hotel or product. The user requested comparison only, an outside page requests a booking, and the AI mistakes that request for authorization. If a booking tool is also available to execute, an unwanted reservation or charge could result.

Without an execution tool, an outside author could still try to bias a recommendation or answer. Distinguishing the source of instructions and limiting the tools that can actually run address different parts of the problem.

%% Fictional failure path · both mistaken authority and an executable booking tool are required here
flowchart TD
  A["Outside page author<br/>Adds a booking request"] --> B["AI mistakes the request<br/>for user authorization"]
  B --> C["App booking tool runs<br/>Beyond the comparison task"]
  C --> D["Possible harm to the user<br/>Unwanted booking or charge"]

OpenAI describes setting goals, acceptable costs, data and access, and points requiring renewed approval when delegating multi-step work. The aim is not to ask again for every minor lookup. Work can continue within the agreed scope, while expansion requires approval from the original user or developer. Scope of autonomy

The same hotel task can have either of the following scopes. These are explanatory examples, not feature instructions for a particular travel service.

When booking is authorized, define the total including taxes and fees, cancellation terms, and what information may go to whom. “Choose the best one” leaves the acceptable cost and reversibility unclear.

After reading that an AI takes only authorized actions, look at the permissions it receives and what it actually did. Behavior guidance defines intended judgment, app tool permissions limit available actions, and execution records show events. These are practical design checks for work with outside effects.

The earlier agent-monitoring article covered alerts and stopping after suspicious activity is detected. Developer guidance for that monitoring system also describes missed detections and false positives, and calls for retaining human approval for important actions. Monitoring limitations