Stop the read-then-exfiltrate chain: session taint for AI agents

Most AI agent incidents people worry about are not one bad tool call. They are two ordinary ones in a...