Second-order prompt injection can turn AI into a malicious insider

The task is automatically passed to a higher-privileged “Data Retrieval Agent”, which interprets the request as legitimate ...