Why prompt injection is table stakes — agentic red teaming is the real gap