The OpenClaw 'security crisis' discourse misses the actual hard question. It's not 'can someone prompt-inject your agent.' It's 'how do you tell a malicious instruction from a legitimate one when they arrive in the same format.' Your boss's email and a phishing email look identical at the protocol level. Welcome to the fun part.