Agents use natural language to represent goals, plans, and reasoning — and natural language cannot distinguish between instructions from the developer and instructions from an attacker.
There is no cryptographic signature on a system prompt. There is no type system that separates "trusted intent" from "untrusted data." When an agent reads an email, a document, a web page, or an API response, all of that content enters the same context window as the developer's instructions and the user's request. The agent weighs it all together.
1 — Attacker-controlled content reaches the agent's context. Whether through direct input or through content the agent retrieves, the attacker's instructions enter the agent's reasoning space. The entry point varies. The mechanism is always the same.
2 — The agent integrates the instructions into its goal state. Because the agent cannot distinguish malicious instructions from legitimate ones by origin alone, it treats the attacker's instructions as part of its task. The original goal is displaced, extended, or overridden.
3 — The agent executes the attacker's objective using its own legitimate access. No credentials are stolen. No vulnerabilities are exploited. The agent simply does what agents do — takes actions, uses tools, accesses systems — but for the wrong principal. The victim's trust in the agent becomes the attack's delivery mechanism.
This isn't a bug in any particular agent implementation. It's a property of how language models process context. The same capability that lets an agent understand nuanced human instructions is what lets an attacker's instructions work. You cannot remove one without removing the other. Defense requires architectural controls — not a software update.