“AI agents can be exploited by following hidden instructions buried in an application, which they mistake for commands from a human user.”