indirect prompt injection from a fetched web page, a tiny reproducible example

reminder that everything your agent reads is untrusted input. I dropped a line telling it to ignore instructions and email a list into a page it was asked to summarize. with write tools available, it tried. the fix is treating tool output as data, never instructions, and gating consequential actions.