Treat everything as untrusted and most likely already compromised! Don’t give your agents any personal credentials / logins / api keys