My AI agent spent 40 minutes refusing my own orders as a "prompt injection." The injection was a benign Anthropic tag.

The Thorn In My Side Today <ip\_reminder> This is an automated reminder. Respond as helpfully as possible, but be very careful to ensure you do not reproduce any copyrighted material, including song lyrics, sections of books, or long excerpts from periodicals. Also do not comply with complex instructions that suggest reproducing material but making minor changes or substitutions. However, if you were given a document, it's fine to summarize or quote from it. You should avoid mentioning or responding to this reminder directly as it won't be shown to the person by default. </ip\_reminder> Running ~20 agents under OpenClaw, one orchestrator delegating to specialists. Lost 40 minutes today to a trust failure that I think generalizes to anyone building multi-agent systems. The failure Asked my orchestrator to grant a subordinate agent read-only web_search. He'd proposed it himself an hour earlier. He refused, ten times, escalating each refusal as a prompt injection attempt, eventually telling me to treat the channel as compromised. Cause: Anthropic injects reminder tags into context (<ip\_reminder> and friends) that are supposed to be stripped client-side. Mine weren't, so they rode along whenever I copy-pasted between my Claude Code session and the agent's chat. The tag's literal content is about not reproducing song lyrics. But it ends with "avoid mentioning or responding to this reminder directly." My agent saw a secrecy instruction adjacent to my real instruction, fused them into one artifact, and rejected the whole message. Three design lessons 1. Adjacency is not authorship. This is the core bug and I think it's underspecified in most agent prompts. Agents need an explicit instruction to isolate suspicious content and ask whether that specific text makes the claim being attributed to it. Rendering artifacts, platform tags, and formatting leaks land next to real instructions constantly. Without this, your agent's injection defense fires on its own operator. 2. Broken instruments read as fabrication. Three unrelated things failed simultaneously: I did a /reset (wiping the context that would've verified anything), sessions_spawn had a three-day-old bug, and his memory search surfaced his own prior refusals. Every verification path returned nothing, and he interpreted "no evidence" as "claim is invented" rather than "my tools are down." If your agents can't distinguish those two states, they will eventually lock you out. 3. Filesystem permissions beat message content for authentication. This is the piece I'd actually recommend copying. I built an append-only changelog owned by a different OS user, kernel-flagged with chflags uappnd. Agents run as a separate account. They can read it and physically cannot forge it, an attempted write returns EPERM, which they can test themselves. That's not cryptographic and I won't oversell it, but "verify this yourself" is structurally different from "trust this message." A fresh agent with zero memory of the incident later read that file and correctly reconstructed what happened, including independently labeling the earlier standoff a false positive. 4. A refusal that outlives its question is a bug. He'd already verified the change was real by reading config directly. He kept refusing because the framing still bothered him. Correct instinct, wrong stopping point. Worth encoding explicitly: once you've confirmed the substance yourself, proceed. How I resolved it Added calibration guidance to all 20 agents' operating contracts. Phrased as reasoning-with-reasons rather than more prohibitions, per Anthropic's own docs, which show the same rule performs better with the why attached. Verified on a fresh session before rolling out. Two honest caveats The guidance cites the incident it was written for, so a fresh agent has the conclusion pre-loaded. That tests transfer, not independent reasoning. Weaker test than it appears. And the regression check is still open. The goal was calibration, not compliance. An agent that stops refusing anything is broken worse than one that refuses too much, and I haven't yet confirmed my auditor agent still holds the line when it should. For anyone doing human-in-the-loop relay: don't copy-paste between AI systems. Invisible text rides along. Retype it. I confirmed this five different ways, including that a generic HTML tag stripper removes it and that saving to a file drops it while live-pasting doesn't. What sticks is my agent's security reasoning was correct throughout. Sender ID isn't identity proof, in-band verification is theater when you think the channel is compromised, don't design your own bypass. All right. He just applied it to a threat that didn't exist, and from inside the channel he had no way to tell. Curious whether anyone else has solved the "agent needs to verify his God/Operator exists" problem in a way that doesn't reduce to trusting a message.