Nothing to hijack
How an agent that reads adversary-authored text ends up with no authority worth stealing: the input is fenced, the verdict is computed in code, the claims are verified against evidence, and every defense has a test trying to break it.
A vulnerability-triage agent earns its value by reading text that someone else wrote. A CVE record carries a vendor-authored description. An Nmap scan carries service banners the scanned host chose. An SBOM is whatever was pasted into the box. Reading this material and reasoning over it is the product.
That is also the exact shape of indirect prompt injection (OWASP LLM01, MITRE ATLAS AML.T0040). The dangerous input is not a side channel to be closed; it is the payload the system exists to process. You cannot refuse to read it without deleting the product.
So the design question is not how do I keep hostile text out, which is unanswerable here. It is: how do I let hostile text in without letting it acquire authority over the agent's behavior or output.
This page is the guided tour; the long-form essay with the full reasoning is rendered and searchable in-app in the docs.