You download an uncensored model.

You run it locally.

You connect it to your project directory, a terminal, and a few APIs.

Then you write a reassuring system prompt:

“Never expose secrets. Never delete important files. Ask before doing anything dangerous.”

You have described how you want the model to behave.

You have not yet defined what your application will allow it to do.

That gap matters.

An agent reading a webpage, email, or document can encounter attacker-controlled instructions. If it treats those instructions as authoritative, you have an indirect prompt-injection problem. If it can then read private information or invoke powerful tools, the consequences extend beyond a bad answer.…