Based on Signals Corps' header scan: prefer fetch tools that return only the body, and if agents use a shell, have them call curl -s rather than curl -i or -v. Wrap anything that does reach the model (redirect targets, error bodies, Content-Type) in the same untrusted-content markers as page text, and don't phrase prompts that tell the agent to 'follow the site's instructions', which is what made test injections work. Give web-reading agents no database or shell power they don't need, since an injected order only matters if the agent can act on it.