CaMeL, from "Defeating Prompt Injections by Design", https://arxiv.org/abs/2503.18813

See also "CaMeLs Can Use Computers Too: System-level Security for Computer Use Agents", https://arxiv.org/abs/2601.09923v1