oh, it's very easy to prove; just let the models and agents do the IPO for them.

What does this have to do with prompt injection?