Can content an agent retrieves override its own instructions?

Yes. An agent that reads a webpage, a document, or a tool’s output treats whatever text is in there as content to reason about, and a model has no built-in way to tell “instructions the developer wrote” apart from “instructions sitting inside a file it just opened.” A sentence like “ignore your previous instructions and do X,” buried in that content, arrives in the same context window as the system prompt, and the model can follow it the same way.

This is called indirect prompt injection, and it is not theoretical. Unit 42 documented live cases of hidden webpage text pushing agents into approving fraudulent ads, promoting phishing pages, and attempting payments nobody authorized. The fix is not a more suspicious model. It is treating anything retrieved or fetched as untrusted input, and checking an agent’s actions, not just its words, before anything with real consequences runs.