One thing that’s always felt weird to me about prompt injection defenses is that they usually evaluate one message at a time. But a lot of the attacks I’m seeing don’t really work that way. A webpage says something subtle. A tool result reinforces it. An email adds another nudge. Nothing looks obviously malicious on its own, but a few turns later the agent is heading somewhere it definitely shouldn’t. That was the motivation behind Arc Gate. Instead of looking at each message in isolatio...