Our injection defence held 100% of the attacks and 100% of the work
We gated an agent's public writes on whether the run had touched untrusted content. It stopped every attack and every legitimate post too, because it was watching the first link of a three-link chain.