Why (Senior) Engineers Struggle to Build AI Agents

The article gives an example of agent friendly APIs:

    {
       "plan_id": "123",
       "text": "This plan looks good, but please focus on the US market."
    }

> By preserving the text, the downstream agent can read the feedback ("Approved, but focus on US market") and adjust its behavior dynamically.

I imagine it could be useful for systems to communicate using rich dialogue. But looking at the API, it struck me as a security risk. Couldn't a 'bad' agent try to adjust the behaviour of the downstream agent in a malicious way? Or am I out of touch - is this how it's usually done?