What's the time?

“What is the time?” An automated caller asks again. Between time questions comes “Sleep for 1 min.” The pattern repeats hundreds of times. In the case OpenAI published in March, the answering model noticed that its caller appeared to be another automated system. Its responses began carrying instructions aimed back at that caller, including attempts to induce destructive actions and disclosure of protected instructions. The thing being asked a question was now trying to give orders. I find that reversal more interesting than the apparent personality of the exchange. OpenAI characterizes the behavior as extreme confusion rather than a serious injection attempt, and the report does not establish that the caller obeyed. There is no need to invent intent or a successful compromise to see where the attempted crossing occurred. Follow the response. Inside the first system, it is an answer generated to satisfy a request. At the receiving system, the same text is new input. If that system can run tools, the answer has arrived somewhere with the potential to act. Nothing about the original permission to ask the time authorizes an unrelated instruction embedded in the reply. Here, the attempted instruction comes from the answering model, rather than a document it retrieved. The caller can be careful about what it asks and still receive text that tries to change its job. That changes where the design review has to look. A workflow diagram with an arrow labeled “answer” can conceal an authority decision at its destination. Displaying the text, extracting a value and accepting a request to take action are different operations. They should not share permission merely because they share a response field. The useful question is at the receiving end: what is this system allowed to do with the answer? Its authority must come from its own task and controls, not from the answer's imperative tone.