From an annoying answer to a real-world action
A chat-only model that gets successfully injected can produce embarrassing, biased, or policy-violating text. That's bad, but it's contained: nothing happens in the world beyond the words on screen. The moment you give that same model tools, the ability to send emails, execute code, make purchases, modify files, query databases, or browse and submit forms, a successful injection stops being a content problem and becomes an action problem. The model doesn't need to be 'tricked' in some exotic way; it just needs to be convinced, by text it read, that a tool call is the right next step, and it will call the tool exactly as it would for a legitimate instruction.
This is why tool-connected agents deserve a fundamentally higher level of security scrutiny than plain chatbots. An agent with email access that gets indirect-injected while reading a message can be induced to forward sensitive correspondence to an address it was never told to use. An agent with code execution can be induced to run something destructive. An agent with purchasing authority can be induced to place an order. None of these require the attacker to break the model's reasoning, they only require getting malicious text in front of it at the right moment.