The email-reading example is the one to sit with: anything a connected tool can read becomes potential instruction input for the model, so a poisoned message or README turns into a command channel. Least privilege per server, and treating all tool-returned content as untrusted data, covers most of it.