A distinct failure mode from prompt injection, and one most agentic security coverage skips entirely.