Wrote this one. The detail that stuck with me: they tested the popular fix, telling the agent to ignore untrusted input. It ran the attacker's command anyway. You can't patch a trust boundary with a sentence that lives inside the thing you don't trust.