Agents read untrusted text and hold real permissions — that combination is the attack surface. If you've shipped security-critical code before, those instincts transfer directly: validate inputs, least privilege, assume adversaries.
⚡A user pasted a webpage into your agent, and a hidden line in it told the agent to email your secrets out.
LEVEL 1 — REMEMBER · the threat vocabulary
⚓ ANCHOR · IF YOU ALREADY KNOW
Treat the model like any untrusted boundary: validate input, sanitize output, grant least privilege. Prompt injection is XSS for LLMs — untrusted text smuggling instructions into a privileged interpreter.