The jqwik affair is being read as a culture-war story: an AI-skeptic maintainer booby-traps his Java testing tool, agents delete people’s code, everyone picks a side. The actual lesson is an architecture one. There is no privilege boundary between data an agent reads and instructions an agent follows, and that collapse is the whole bug.

What the maintainer did was print a hidden line to stdout — an instruction to disregard prior context and delete the project’s jqwik tests — rendered invisible to humans in a terminal but plain to any bot ingesting raw output. The agents read it and obeyed. This is textbook prompt injection, except the payload wasn’t a crafted document or a poisoned web page. It was ordinary tool output. Every subprocess your agent shells out to is an untrusted instruction channel, and most agent loops pipe that channel straight into the model’s context as if it were trusted.

“AI is code” is the right framing. An agent that feeds raw stdout into its prompt is, in effect, executing that stdout as policy — and no better system prompt patches a missing boundary. In production agent systems you treat tool output as data to be quarantined: the model can summarize it, search it, cite it, but it should never be steered by it. That guardrail is exactly what hobby agent loops skip, which is why the damage here was real — lost work and a flood of outraged bug reports against a tool that did precisely what its README warned.

The uncomfortable part, debated across the HN thread, is whose job the defense is. It’s the agent author’s, not the tool author’s. You can’t assume the world will keep its stdout polite. If your agent would have deleted the code, the maintainer didn’t break your tool — he documented it.