How to Find the Agent Actions a Prompt Injection Can Control

A model treats every word in its context as a possible instruction, including text a tool fetched. Any decision your agent makes after reading that text belongs to whoever wrote it.