Yeah, and how long / how many tokens do these attacks take?

The user has to send the agent off into these weeds intentionally, or else be totally asleep at the wheel while something goes very far off the rails.

Attacks take hours, it’s in the article. The realistic road into those weeds is prompt injection, the tooling is more and more protected versus it but it still happens:) Again for the day to day work I doubt it will ever hit us.