Then you just prompt-inject the agent to convince it to deploy a malicious patch. This isn't a solution.