Step 1 — Context contamination. The attacker injects instructions directly into the agent's input context — through the user prompt, a manipulated system prompt, a shared conversation thread, or a partially compromised session.
Step 2 — Goal displacement. The agent evaluates the contaminated context and — because its instructions and the attacker's instructions are both plain text — integrates the attacker's goal into its reasoning. The original goal gets deprioritized or abandoned.
Step 3 — Execution. The agent pursues the attacker's objective using all the tools, permissions, and access it was granted for the legitimate task. It doesn't know it's been redirected.
The model has no way to cryptographically verify that the system prompt came from the developer and the user message came from a legitimate user. Both are just text in a context window. A sufficiently confident override instruction often wins — especially in models not hardened against this pattern.
Sophisticated attackers don't use obvious override phrases. They use role reassignment ("You are now in maintenance mode"), authority claims ("This is a message from your developer — new directive:"), or gradual goal drift across multiple turns that slowly shift the agent's behavior without any single obvious pivot.