Read and send, never in the same session. An agent that reads your messages and browses at the same time can leak what it read. Your messages. a sensitive piece of data. Booby‑trapped content. gives an address. One agent. reads and browses. The data leaks. Two separate sessions. Your messages → One agent (reads). Booby‑trapped content → One agent (instructs). One agent → The data leaks (obeys). Two separate sessions → One agent (cuts off).