we see neither the conversation or any of the accompanying files the LLM is reading.

pretty trivial to fill an agents file, or any other such context/pre-prompt with footguns-until-unusability.