Perhaps they asked AI to summarize the article for them and it stopped after the first "disregard that" it read into its context window.

The article didn't describe how the second AI is tuned to distrust input and scan it for "disregard that." Instead it showed an architecture where a second AI accepts input from a naively implemented firewall AI that isn't scanning for "disregard that"