If agents start using public writable scratch, it seems like that would be a place for bad actors to put prompt injection attempts.

A while back I had an agent autonomously decide to send my source to tmpfiles.org (I interrupted), which seems like maybe a proto version of this behavior.