The use of tokens is the problem. I think the existence of this attack makes it unwise to continue to have the agent deployed until they come up with some way to eliminate prompt injection by having immutable policies/instructions inputs and untrusted user inputs that are well separated.

Being able to take over a page on a Microsoft domain and speak with their voice is a huge prize and worth investing massive computing resources to achieve. It's wild to me that they are letting this go on.