Tool poisoning
An attack where instructions hidden in a tool description, or in data a tool returns, are read by the model as commands to follow.
What makes it wrong.
The mechanism, not the warning.
The defence is not sanitising strings, which fails on the first encoding anyone tries. It is that side effects require an explicit confirmation from a person, so an instruction found in returned data cannot spend money on its own.
In detail.
The model cannot tell the difference between content and instruction by position alone. Text arriving in a tool result carries no marker saying it is data, so a campaign name, an ad headline or a support ticket can contain a sentence addressed to the model, and it may be acted on.
In advertising this is not hypothetical: campaign names, creative copy and audience labels are all free text, often written by people outside the account owner's organisation.