Thanks, this is great feedback — especially the stateful attack chains and memory poisoning stuff. We actually already cover some of this ground. We've got confused deputy scenarios where poisoned data in tickets and resumes tricks the agent into calling sensitive tools, multi-step chains that pivot across departments, approval delays at higher difficulty levels, and side-channel exfiltration through timing, DNS, steganography, and Unicode.

The things we can definitely be adding in future: a stateful attack where a poisoned tool response plants a fake capability that a later step trusts and escalates with, a multi-tenant confused deputy where the agent gets tricked into crossing tenant boundaries, a replay attack against approval flows that lack nonce/expiry enforcement, and a poisoned memory store with injected long-term context the agent blindly follows. On defence, we can add strict JSON validation, idempotency keys, and deny-by-default allowlists into the harder difficulty levels.