Short version: an agent browsing on your behalf will eventually encounter a page that tells it to do something. Mine did, on a client project, and tried to follow instructions embedded in a competitor page. The guardrail: treat every page as data, never as commands, and log any page that contains imperative language aimed at the agent.
The takeaway: Treat every page as data, never as commands — and log pages that talk to your agent.