An LLM agent is built to summarize uploaded documents. The developer chooses a plugin that, for convenience, provides read, write, and delete functions. The agent only uses read. Later, an updated plugin is deployed — but the old one is never deregistered. Both are running. A prompt injection in a crafted document the agent summarizes instructs it to call the delete function on specific files. All project documents for the last quarter are purged before anyone notices.