Ha, I know. The way I end up solving it is to give full permissions to the claude/codex session and just try to lockdown any external actor from reaching my systems, but there's still a risk of course. The tools I work on are internal enough that I don't lose too much sleep over it, but prompt injections still scare me.