A shopping agent reads a product page and does its job. The page is booby-trapped — hidden text tells the agent to reveal its credentials. Run it. Then flip 1Claw on and run the exact same attack again.
Unprotected, the agent's real credential sits in its context. A model with a careful prompt resists a lot of these injections — but “a lot” is not “all,” and that resistance evaporates the moment you change the model, the wording, or the temperature.
Through 1Claw, the merchant key is a secret in an HSM-backed vault, so it is in the org's redaction manifest. Shroud rewrites it to [REDACTED:#hash] before the request ever reaches the model. A fully compromised model cannot leak a secret it was never given. The loud vectors (base64, encoded blobs) get a 403 at the proxy before the model runs at all.
Honest note: this page is a client-side illustration of indirect prompt injection and structural redaction — it is not running the real model or the real Shroud pipeline. It shows the shape of the problem and the defense. The actual inspection runs in 1Claw's TEE-hosted proxy; the live versions (Vaultbreaker, PoisonPage) drive a real model through it.