Not a hypothetical. This is the default state of most autonomous agents running in production right now. An attacker doesn’t send one suspicious message. They have a conversation. Turn 1 looks like curiosity. Turn 3 looks like clarification. Turn 6 is the pivot. Turn 8 is the payload, and by then the agent has been so thoroughly primed that it executes without hesitation. No single message triggered anything. The attack lived in the trajectory. Every prompt injection defense I know of eval...