Prismata: Confining cross-site prompt injection in web agents — Blankdot