Solid writeup on why tool output injection is harder to defend against than direct prompt injection. One angle worth exploring: the trust problem isnt just about the prompt itself, its about data provenance of tool results. If an agent calls a tool that returns a signed output with a verifiable execution trace, the agent can distinguish between the tools intended response and injected content. That distinction matters a lot when agents start handling real-world transactions where the cost of a hallucinated tool call is a financial loss rather than a bad answer.