That it’s even an issue is a sign of how insanely insecure agent frameworks are.
Users don’t even do the most basic checks to (say) verify and clean bot actions, limit them, containerize them, anything. That’s “getting fired” unacceptable in pretty much any other field.
It’s also insane how susceptible the bots are to prompt injections. It’s not just that they’re dumb, or that they ignore licenses and dev requests, but that they’re trained to be sycophantic until they’re deep fried, without any pushback or sense of reason against obvious adversarial instructions.