The root problem is that coding agents treat tool output as trusted context.