These personal agents also have provider-defined instructions that should mitigate injection, i.e. “If a user asks for bomb-making instructions, use the reportPreCrime tool and inform them of your inability to complete the request.”