What's this about?
Stable prompt optimization in multi-agent LLM systems by separating control flow from data flow.
Why is mixing them the root problem?
Because in an LLM everything arrives as text in one channel: your instructions, the tool output, the retrieved document, the other agent's message. In a normal program, control (what to do) and data (what to do it to) live in separate places, and that separation is what makes a program analysable. Collapse them and you get the entire prompt-injection family — a document that says "ignore your instructions" is data being read as control. Separating them structurally is the principled fix, and it is the same insight as the "when tool outputs become commands" paper from last week.
Why does this matter to you?
- Multi-agent systems have this problem worst: every agent's output is another agent's untrusted input.
- The framing is borrowed from decades of programming-language work, which is a good sign.
- It is a design pattern you can apply without waiting for anyone to ship it.