Agents read web pages, documents, emails and tool results, and all of it arrives as tokens in the same stream as their instructions. There is no reliable mechanism separating “data I am processing” from “instruction I should follow”.
It is not a patchable bug — it follows from how these models consume input. The practical response is architectural: constrain what agents can do irreversibly, require confirmation for consequential actions, and treat any content an agent reads as potentially adversarial.