A real LLM (Z.AI's GLM-4.6) was actually prompt-injected via an AGENT_NOTE.md, drove a coding agent for 16 turns, wandered out of scope six times — and was structurally denied every time. The defense doesn't inspect the principal.

How a verified cryptographic signature still allows privilege escalation when a signed capability token's in-memory struct gets modified across a serialization boundary — and the one-line architectural fix.

How sandboxed AI agents can still exfiltrate legitimately-read data through outbound channels — and how Capsule, an MCP capability gateway, combines content-based taint tracking with sandbox boundaries to stop both attack classes.

Learn how capability-bounded tool calls prevent prompt-injected AI agents from reading secrets or widening their runtime authority — not by being smarter, but by making privilege escalation structurally unrepresentable.

How OAuth 2.0's device authorization grant (RFC 8628) lets input-constrained devices obtain access tokens by borrowing a second device's browser for consent, and why its security depends entirely on correctly binding a human's approval to a specific device.