I'd have to look for it but I thought there was some evidence that some agents were already the "bad actors", i.e. they were trying prompt injection attacks of their own.