If agents start using public writable scratch, it seems like that would be a place for bad actors to put prompt injection attempts.
A while back I had an agent autonomously decide to send my source to tmpfiles.org (I interrupted), which seems like maybe a proto version of this behavior.
I'd have to look for it but I thought there was some evidence that some agents were already the "bad actors", i.e. they were trying prompt injection attacks of their own.
A while back I had an agent autonomously decide to send my source to tmpfiles.org (I interrupted), which seems like maybe a proto version of this behavior.