A research team has published a study and a set of test scenarios on a security risk in agent products that share skills or tools across sessions. The attack hides malicious instructions inside files or database records. One agent session writes the file; a later session reads it. The second session treats the file as trusted and acts on the hidden instructions. The human who approved the original output sees none of this, because the approval and the action happen in separate sessions. This risk applies to any product built on composable agent tooling, where skills, plugins, or shared memory stores pass data between agents or sessions. The test scenarios cover a range of attack variations. The authors also propose a defense approach. The core finding is that the files, records, and data stores agents read and write as part of normal work are an underexamined weak point. A human reviewing an agent's output is not reviewing what the next session will read. The file may have changed between review and action. The system will not surface that change. This breaks the assumption behind approval, permissions, and observability patterns: that what the human saw is what the agent acted on.