Could an AI agent tag data by its source, so a trusted instruction and a sneaky line from a web page are never treated the same?

This explores how an agent could put a label on data as it moves from documents it reads into the tool calls it makes, so a system can tell whether an email address, file path or command came from the trusted user or from untrusted text. The short answer: the collection doesn't yet contain papers on taint tracking or information-flow control for agents, the security research that tackles this most directly. What it does have are neighboring ideas that show why the problem is hard and what building blocks exist.

The closest structural idea is separating reasoning from tool outputs. ReWOO and Chain-of-Abstraction both have the model plan with abstract placeholders ("the result of step 2") instead of pasting raw tool responses back into its reasoning Can reasoning and tool execution be truly decoupled?. Those papers were after efficiency, not security. But a placeholder is already a kind of label: it names a value by where it came from, and the planner never reads what's inside it. Most labeling defenses rest on this same move. If the part that decides what to do never reads the untrusted content, that content can't hijack the plan, and each placeholder is a natural spot to attach a "came from document X" tag.

The collection also shows why tracking matters once data starts moving. In long delegated workflows, even frontier models silently corrupt about a quarter of a document's content, and the errors build up without being noticed Do frontier LLMs silently corrupt documents in long workflows?. Stronger models fail by subtly changing content rather than visibly deleting it, which makes the damage harder to spot Does model capability change how documents degrade?. Put plainly: once text passes through a model, you can't trust by inspection that what comes out matches what went in. Labels have to be attached and carried along on purpose, outside the model, not worked out after the fact.

There's a weaker, statistical kind of provenance too. Classifiers can tell which LLM wrote a text with 97% accuracy from word choice alone Can we identify which LLM wrote a given text?. AI-generated contributions also leave timing patterns in how writing and code get made Can process data distinguish AI delegation from ordinary collaboration?. These show that content carries traces of where it came from. But they're probabilistic and work only after the fact, which is the opposite of what a security label needs to be. A tool-call guard has to know for certain where an argument came from at the moment of the call, not guess it later.

The takeaway you might not have expected: agent efficiency research and agent security research arrive at the same design from different sides. Keep the planner away from raw data and pass references instead. If you want the real labeling mechanisms (taint propagation, capability tags, policy checks before a tool runs), you'll need sources beyond this collection for now. That gap makes this a good line to grow.