Or putting it into the image for the screenshot-driven agents a la https://simonwillison.net/2023/Oct/14/multi-modal-prompt-inj...