A few weeks ago I gave an LLM-driven coding agent the ability to run shell commands on a scratch server, and within ten minutes of unconstrained experimentation it tried to curl a metadata endpoint, write outside its working directory, and read my shell history file. None of that was malicious — the model was just being helpful in the broadest possible sense of "helpful." But it made something click for me: we keep debating prompt injection as a text problem while handing agents filesystem an...