Overt prompt injection is becoming harder, but research into conversation stearing has lead to new less obvious ways to modify what direction they move in.

Also any longer running agent can lose track of the original prompt and start going off the rails.