If you’re willing to serve adversarial Markdown to agents, you’re already willing to cloak HTML.