Thanks for chiming in. I agree this is not a one-click account takeover. But I think point 2 is broader than that. The user does not need to ask about the mal

Thanks for chiming in. I agree this is not a one-click account takeover. But I think point 2 is broader than that. The user does not need to ask about the malicious transaction specifically. Any normal question that makes the agent fetch recent transactions could bring the attacker-controlled text into the LLM context.