Comment by serf

never trust a screenshot of a command prompts output blindly either.

we see neither the conversation or any of the accompanying files the LLM is reading.

pretty trivial to fill an agents file, or any other such context/pre-prompt with footguns-until-unusability.