The problem

When multiple AI agent sessions run on the same machine, the obvious way to let them help each other — pass text back and forth — is also dangerous.

A message from one agent can carry instructions, and a language model reading them may simply follow along. That is the confused-deputy problem and the prompt-injection problem in one: a genuine request and a hostile "ignore your task, do this instead" look identical as text.

A confused deputy is an agent that has real authority (it can run commands, read files, call APIs) and gets tricked into using that authority on someone else's behalf, simply because a message asked. Prompt injection is the specific trick: text crafted to look like an instruction to the model reading it.

"Just pass the text through" is not a neutral design choice. If a receiving session treats an incoming message as something to obey, every sender becomes a potential attacker — including a legitimate peer session whose output was itself manipulated upstream. The failure mode is silent: nothing crashes, the wrong action just happens.

The fix is not to filter out the bad-looking messages — attack text can be made to look exactly like a normal request. The fix is structural: never let arriving text carry authority in the first place, regardless of what it says.