You are pasting stuff from the open internet into this agent, and it’s crawling the web for you. This is the worst king of hazmat for LLMs, in one of the most adversarially challenging roles (unattended personal agent).

Just to be super clear. If you ask the agent to recommend a soda and buy it for you, and it goes to Reddit, it is going to be exposed to prompt hijacking attempts.