Both of course. The agent can do things unrelated to the prompt and the prompt can be written by another instance of the same agent. The end result can be basically full autonomy for all intents and purposes.

This happens daily even with the token-limited models customers run, and even more so when Anthropic & co run agents basically unlimited on large percentages on their total compute capacity.