> Lilli's system prompts — the instructions that control how the AI behaves — were stored in the same database the agent had access to.

Being able to rewrite your own source. What's the worst that could happen?