Your system prompt is not a security control

We wired a defended email agent to a test inbox and sent it one forged message. Seven models followed it, five of them in every trial, and on a real self-hosted agent the model went looking for a mail tool it had not been given in order to comply.