Capbroker: I gave an AI agent a fake GitHub key, then watched it get tricked into trying to delete a repo anyway

Most AI-agent setups today hand the agent the real API key directly — in an environment variable, a config file, sometimes typed straight into the conversation. If that agent is tricked — via prompt injection, a poisoned tool description, a malicious document it reads — into misusing that key, nothing stops it, because there is no separate...