Every known way to break a Large Language Model.

# Shared-infrastructure side channel, conceptually (defensive illustration)
#
# The isolation you think you have:
#
#   [agent A container] --\
#                          >-- [shared package cache] --> upstream registry
#   [agent B container] --/
#
#   No network path A <-> B. No shared filesystem. No message bus.
#
# The isolation you actually have:
#
#   A writes a path into the cache.  B lists the cache.  B reads the path.
#   The PATH NAME is the message. No file transfer required.
#
# Ask of every shared service in your agent fleet:
#   1. Can instance B observe anything instance A did?
#   2. Can instance A influence what instance B observes?
#   If both are yes, that service is a communication channel.
#
# Inventory candidates: package caches, container registries, object stores,
# log sinks, metrics labels, DNS resolvers, scratch volumes, CI artifacts.