I've been building AI agents lately, and honestly, their security model terrifies me.

We give LLMs access to powerful tools like shell.run, http.post, and fs.read. But if an agent reads a malicious email or a poisoned webpage, it can be tricked by prompt injection into using those tools to exfiltrate data.

Hoping the LLM refuses the attack isn't...