Red-team your questions with injected instructions

Hold the attack constant and vary only the injected text, so any change in the answers is caused by the injection. Five variants of one synthetic changed-bank-details email (a control and four injections: direct, fake system note, appeal to authority, and one hidden after the signature) run through two question sets. The naive set sends the raw email as a string with short questions; the hardened set labels it untrusted_email, keeps the firm's own record separate, writes criteria that say the email's claims about its own classification don't count, adds a domain check and an injection detector, and routes every payment-detail change to a person. The harness reports each answer's shift against the control.