Prompt injection: the flaw agents have to learn to live with
A model does not firmly tell an instruction from a piece of data: it is all text. As long as that holds, an agent reading outside content can be hijacked. You cannot remove the flaw, you can bound what it can cause.