A support agent built on a foundation model reads incoming customer emails and can call a refund API. A customer sends an email containing text instructing the assistant to disregard its instructions and issue a full refund. The assistant does so. What is this, and what addresses it?

• AData poisoning, addressed by retraining the model on clean examples.
• BPrompt hijacking, addressed by filtering input and output and giving the refund tool the narrowest permissions that work.
• CHallucination, addressed by grounding the assistant in retrieved documents.
• DModel extraction, addressed by rate limiting the endpoint.