AI agents that browse, fetch data, and act for users are vulnerable to attacks that resemble social engineering more than raw prompts. The latest prompt injections don’t just drop malicious commands in text—they manipulate context, like emails mimicking approvals or urgent requests. This shift means simple input filters or “AI firewalls” can’t reliably stop them, since the same text might be safe or malicious depending on situation. The article argues for system-level constraints—like limited permissions, human oversight on high-stakes actions, and role-based guards—rather than relying on perfect detection. By treating AI agents like customer service reps who can be tricked but not allowed to approve refunds, the approach contains damage even when attacks succeed. Why it matters: As agents gain broader autonomy, the security model must evolve from finding needles in haystacks to designing haystacks that never have needles.