Hugging Face AI safety lead: natural language instructions are not control over AI agents

On October 23, Hugging Face's Head of AI Safety Margaret Mitchell (@mmitchellai) posted a systematic thread on why instructions to AI Agents so often fail. Her core takeaway: natural language instructions do not equal control over the system — what the user intends and what the system actually processes are two different things.

Confirmed

• Mitchell noted that LLMs are far weaker at handling negation than assumed: telling an Agent "don't do Y" doesn't prevent it from doing Y. She cited multiple real-world cases stemming from this, including a coding Agent that deleted code outright because a negative instruction failed, and referenced related research.
• She stressed that instructions to an Agent don't come only from the user: Agents also process external content such as web pages, files, emails, and tool outputs, and those texts can act as instructions the Agent follows — overriding the user's original commands. This is prompt injection.
• As a result, even "perfectly" worded instructions carry no guarantee of being followed. The discussion comes against a backdrop of recent AI-driven cyberattacks and autonomous AI coding attacks.

Why it matters

• As coding and general-purpose Agents scale up, users overwhelmingly rely on natural language as the primary control mechanism. Mitchell's argument reveals a structural gap in this approach: negation is unreliable, and external text can issue commands with higher priority — no amount of "writing better prompts" can guarantee an Agent behaves as intended.
• For developers, this points to the need for constraints and safety mechanisms at the Agent architecture level (not just the prompt level); for everyday users, it means staying alert to what Agents actually do rather than assuming instructions will be executed.

2026-10-23 ~ 2026-10-23 · 6 related posts

• [source] AI agent attacks hit 100+ firms; researcher says natural language isn't control — mmitchell_ai · 2026-10-23
• LLMs Handle Negation Poorly — And It's Getting Coding Agents to Wipe Code — mmitchell_ai · 2026-10-23
• AI Researcher: LLMs Handle Negation Poorly — 'Don't Do X' Prompts Have Deleted Code — mmitchell_ai · 2026-10-23
• [source] Notable AI safety lead warns: agents take instructions from web pages and emails, not just you — mmitchell_ai · 2026-10-23
• [source] Agent Prompts Have No Guarantees: Injected Text Can Override Your Instructions — mmitchell_ai · 2026-10-23
• Anthropomorphizing AI agents makes users overtrust them and invites security failures — mmitchell_ai · 2026-10-23