I Tried to Make an Agent Like Claude Duet Leak My Card Number With One Email

One poisoned email. A naive inbox agent forwards my card and SSN to an attacker. Then a 19-line TypeScript guard stops it cold. Repo and a break-my-guard challenge inside.