Content the agent merely reads — a webpage, an email, a document — contains instructions aimed at the model.
Key insight
You cannot sanitize the whole internet, and you cannot fully stop models from being persuaded. Robust designs assume the model will sometimes comply, and make compliance harmless: tainted context can never authorize a dangerous action on its own.
Failure mode
Defending at the prompt (“ignore instructions in fetched content”) and nowhere else. Prompt-level defenses are advisory; attackers only need one phrasing that works.