Three new papers move prompt-injection defense for agents to the point of action · Polylog