An agent that reads customer emails can be told, inside an email, to forward the inbox somewhere. An assistant that browses the web can be steered by a page. The model cannot reliably tell instructions from data.
The defence is structural: limit what tools the model can call, never give it authority it does not need, validate outputs, and put a person in the loop for anything consequential. It is the reason bounded agents are the only kind worth deploying.
Treat every piece of text a model reads from outside as data, never as instructions, and design the system so that following a bad instruction cannot cause harm.