This is @simonw’s Lethal Trifecta [1] again - access to private data and untrusted input are arguably the purpose of enterprise agents, so any external communication is unsafe. Markdown images are just the ones people usually forget about
Good point around the markdown image as an untrusted vector.
Lethal trifecta is determnistically preventable, it really should be addressed wider in the indutry