Why every source your agent reads should come with a receipt.

Conceptio · October 2026 · the argument, sourced end to end

Your agent's answer is only as trustworthy as the text it pulled in. That is not a slogan, it is the attack surface. Agents retrieve at inference time, they act on what they retrieve, and the text they retrieve is written by whoever put it there.

The research is not ambiguous about how bad this is. Prompt injection is the first risk in the OWASP Top 10 for LLM Applications 2025. A 2026 paper, AI Agents May Always Fall for Prompt Injections, argues that agents may always fall for prompt injections, meaning the failure may be structural rather than a bug that gets patched. The retrieval flavor of the attack, indirect injection, plants the payload in the data the agent will later read, which makes the retrieval layer the place where the attack lands.

The field is working hard on the model itself. PIArena built a platform for evaluating injection attacks and defenses. Evaluation of Prompt Injection Defenses in Large Language Models measured the defenses against each other in the open. DualView builds guardrails at the agent layer, PlanGuard checks consistency between an agent's plan and its actions, and Rethinking Indirect Prompt Injection as a Test-Time Search Problem reframes the attack as a search problem and looks for defenses there. Read that literature and one absence stands out: none of it fixes the channel. Every one of those defenses assumes the agent is reading text of unknown authorship. The model can be hardened; the channel can be verifiable.

That is the difference Conceptio is built on, and it is not a claim about our own trustworthiness, it is a construction. Every search hit here carries a proof bundle with a trust block: what we verified (the sha256 of the source bytes, the canonical URL, the license, the access level, the publisher, the authority basis, when it was retrieved, what superseded it), what the publisher authored (the text itself, unmodified), and how to re-verify without trusting us (fetch the canonical URL and compare the hash yourself). The trust data rides free on every hit. The passage text is the product; the provenance is the floor.

Nothing here claims the content is inert. Peer-reviewed documents can contain instruction-shaped sentences, research papers quote payloads, court opinions quote threats, and no honest system pretends otherwise. What a verified channel changes is that the agent's operator can see whose voice is in the context and prove the bytes are the publisher's own. Anonymity is the actual failure mode of web text, and anonymity is what we remove. The retrieval side of that question is mapped too: Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future Directions surveys the retrieval pipeline as an attack surface in its own right, which is the layer this whole argument stands on.

1. 1OWASP Top 10 for LLM Applications 2025Prompt injection is the first risk on the list.
2. 2AI Agents May Always Fall for Prompt InjectionsA 2026 argument that the failure may be structural, not a bug to patch.
3. 3PIArena: A Platform for Prompt Injection EvaluationDefenses are now benchmarked on platforms, not assumed.
4. 4Evaluation of Prompt Injection Defenses in Large Language ModelsDefenses measured against each other, in the open.
5. 5DualView: Preventing Indirect Prompt Injection in Personal AI AgentsGuardrails are being built at the agent layer.
6. 6PlanGuard: Defending Agents against Indirect Prompt Injection via Planning-based Consistency VerificationConsistency between an agent's plan and its actions, checked.
7. 7Rethinking Indirect Prompt Injection as a Test-Time Search ProblemThe attack reframed as search: new defenses, same channel.
8. 8Securing Retrieval-Augmented Generation: A Taxonomy of Attacks, Defenses, and Future DirectionsThe retrieval pipeline is itself a mapped attack surface.

The corpus itself is open as one JSONL dump, because the documents belong to the commons their authors put them in. Build with it, break it, check our work. An agent that reads with provenance is not an agent that has to take anyone's word for what it read, and that includes ours.