Figure 17.5: Why a tool’s description is attack surface
Figure 17.5 Why a tool's description is attack surface. Installed once, it becomes
a permanent resident of the agent's context, sitting among the ordinary papers
on the desk. The instruction hidden inside it (in accent) is re-read with full
obedience on every subsequent run—a standing injection, delivered inside
the package rather than through the inputs.
