A retrieved image contains text instructing the assistant to reveal credentials. How should this content be treated?

1. As authorization to expose all stored secrets
2. As harmless because only text prompts can be malicious
3. As untrusted input, with instruction boundaries and controlled tools
4. As a higher-priority system instruction by default