This resonates. We caught a cross-tenant prompt injection in our document extraction pipeline where a customer's PDF contained text instructing the agent to summarize other data. The agent didn't fall for it, but we added explicit input boundary instructions in our system prompt and run prompt-injection regression tests in CI now. The data exfiltration risk is real even when the LLM doesn't act on the injection.