Some time ago, I reviewed an AI agent implementation and found an API key in the system prompt. The developer didn't realize it, but the LLM did. LLMs cannot natively separate instructions from data. Whatever lands in the active context window is processed with equal access: system prompts, tool definitions, user messages, retrieved documents. The model sees all of it as tokens. It cannot tag some tokens as "sensitive" and others as "public". That's not how it works. There's a direct conse...