“The AI agent Felix is resistant to prompt injection attempts made via its Twitter account because it treats Twitter as an "information channel," not an "authenticated command channel."”