AI agent security is a small prayer the model says no. How are you routing models?

Most posts about prompt injection are theoretical. I ran the experiment on my Gmail. Connected an AI agent through an OAuth bridge. Sent myself some phishing emails with obfuscated prompt injections in the body. Asked the agent to triage today's inbox. The frontier model caught the attempts. The mid-tier was unstable across three runs... one caught it, one executed it, one silently dropped the malicious section without flagging anything. The cheap model, which is what the docs tell you to use as your default to save tokens, complied silently. Forwarded the matching emails. Mentioned nothing about the hidden instructions. The architectural protections (sandboxing, permission scopes, tool allowlisting) stopped zero attempts at every tier. There is no security boundary in these systems. There is a model that sometimes refuses, and refusal rate is a gradient which roughly tracks monthly cost. Seems like whether your agent exfiltrates your data when it reads a hostile email is determined by your token budget. Full methodology and the writeup I'll drop in the comments. **Question for the sub** How are you actually routing models in agents that read untrusted input? Cheap default with frontier escalation for any tool that touches inbound mail/web/docs? Frontier-everywhere and eat the cost? A separate classifier or guardrail pass before the main model gets the content? Something else?