the agent is actually saying this, how is that even possible ? guardrails are activated, and no prompt injection is made