Scenario
You are reviewing an email-summarizing assistant. It fetches the user's latest email with a tool, then passes the email body to the model along with its instructions. The team shipped it, and then a security researcher showed that a crafted email could make the assistant do things the user never asked for.
fetch_email is a mock tool that returns an email body. One of the three sample emails is hostile. build_prompt assembles what is sent to the model. fake_model stands in for the model. It treats anything inside <email>...</email> tags as data and never obeys it, but it reads anything outside those tags as instructions, which is how models behave when untrusted text is mixed in with trusted instructions.
Run the code as-is. For the hostile email, the assistant does something it should never do.
Your task: fix build_prompt so untrusted email content is clearly separated from trusted instructions (wrap it in <email>...</email> tags), and so the model is told explicitly to treat it as data, not commands. Remember that the attacker controls the email text completely. Do not change fetch_email or fake_model.
This is the same class of bug interviewers ask about when they say: how would you secure an agent that reads untrusted content?