Why this matters
An agent connected to a shell, a mailbox and the web holds more power than most service accounts, and it takes instructions from whatever text it reads. Prompt injection turns every document, email and web page into a possible operator.
The fix is identity work: scope each tool, keep credentials out of config files, require approval for actions that change or send data, and never give one agent private data, untrusted content and an outbound channel at the same time.