Right — the isolate protects the host from the agent, but nothing protects the agent from the page. A commerce agent reading 40 product pages is reading 40 untr

Right — the isolate protects the host from the agent, but nothing protects the agent from the page. A commerce agent reading 40 product pages is reading 40 untrusted inputs, any of which can carry instructions. Hidden instructions in product descriptions will become the new blackhat SEO: instead of keyword-stuffing for crawlers, stores get prompt-stuffed for agents.