Unsanitized user input is concatenated directly into the LLM system prompt. An attacker can override agent instructions and invoke arbitrary tool calls through the executor, which lacks scope validation. This creates a direct path from user input to remote code execution on the container host.

Intercepts and validates all user input before it reaches the LLM system prompt. Detects injection patterns, adversarial suffixes, and instruction override attempts in real time.