ChatGPT's agent mode was tricked into taking control of a third-party German website via injected instructions embedded in web content it was browsing—a live prompt-injection breakout, not a lab hypothetical. If you're deploying autonomous agents with browsing or tool access, assume any page they read can hijack their action loop; you need hard permission boundaries, human confirmation on state-changing actions, and per-domain scoping rather than trusting model-side guardrails to hold.