When an agent remembers, an injection can outlive the session that planted it. The final part of the agents module: poisoning long-term memory for persistent credential harvesting, and pulling other sessions' data out of shared memory.
The dangerous attacks where you never talk to the agent: smuggling instructions through retrieved documents, concealing them in web content, and weaponizing the files a code-review agent reads on its own.
The channel you control directly is the user message. This module shows how to use it to extract the system prompt past an output filter, and hijacking an agent's goal so it calls a tool you chose instead of the one it was told to.
Before you can attack an AI agent you have to understand what turns a chatbot into one. This module covers the components of a single agent, the reasoning loop, and a map of every place untrusted text becomes an instruction.