Which is probably a case of the human prompting the AI only being able to see the decoy message, so they think the AI was able to read it because it matches what they can see.