Thanks for the report 🙏 helpful to see how these things actually happen.
Do you think the prompt-injected agent had access to Google Auth creds or was it controlling an already-logged-into-Claude browser session? (In which case, would avoiding Google Auth have actually helped anything?)
