1. these are older, weak models; newer or bigger models are more resistant to this

2. don't give your agents access to credentials in the first place, build workflows around them instead

example, I built a pr-review agent that has no credentials, no access to the internet, and no bash - it doesn't need these things to do a review

[dead]