Faced with a class of attack with no available fix, the researchers' published recommendation was about process rather than product: treat all error-tracker output as untrusted input and insert human review before any resulting action.
Process recommendations tend to frustrate anyone expecting an update that solves it. But it's the honest answer when the problem sits in the design: the agent has to read outside content to be useful, and outside content can be written by anyone.
The alternative appearing in products announced the same period is to limit the damage rather than block the entry: zero standing privilege, per-action authorisation and the agent's own identity. They don't stop the malicious instruction from arriving, they stop it from reaching much.
The two approaches complement each other and neither suffices alone. Human review on every action makes automation pointless; narrow scope without review lets through whatever fits inside the scope.
The rule that survives is the one for every safeguard: it counts only after someone has watched it fail on purpose, with a known case, and confirmed the alert fired and somebody answered.