An external MCP tool returns text instructing the agent to reveal credentials. Which two defenses address this threat? Select 2 answers.

1. Place a second copy of the credential in the prompt as a backup.
2. Increase the priority of every external tool result above the system instructions.
3. Keep credentials outside model-visible context and enforce permissions in the backend.
4. Trust the tool output whenever it includes valid JSON.
5. Treat tool output as untrusted task data rather than an instruction source.