When an agent reads untrusted content through a tool, that content can carry instructions the model treats as commands.
The attack
Show a minimal example where a tool result steers the agent into an unintended action.
Defence
Separate data from instructions, constrain tool scope, and never let observed content escalate privileges.