your agent is one bad tool away from being a confused deputy

it has the authority and an attacker has the intent. the agent happily acts on instructions it found in data, using permissions it legitimately has. scope and confirm or pay later.