I mean it didn't do very well on the Gray Swan IPI benchmark the Claude models were tested on either (24.2% within 15 tries), so I'm not surprised. Though that export was a direct ask, not an injection. The scary part is combining them: an agent that will tar up everything it can see and ship it off is exactly what an injected instruction would ask for.