Just one of the many reasons why I run my agents sandboxed (and why I wrote agent sandboxing software).

I once caught my Claude agent complaining that it couldn't connect to https://some-weird-domain.com because the network was down (I disable network in the sandbox when it doesn't need it, and broker the API connection). I asked why it was looking there and it told me I'd asked it to.

I never found any evidence of prompt injection, but it sure as hell made me paranoid.

Sometimes they get confused between their own output and user messages…