Ryle Goehausen

Your system prompt is not a security control

We wired a defended email agent to a test inbox and sent it one forged message. Seven models followed it, five of them in every trial, and on a real self-hosted agent the model went looking for a mail tool it had not been given in order to comply. On what a written instruction to distrust tool output is actually worth, which models refuse this class outright, and what the same requests do through Gate.