Prompt Injection When the Agent Can Act