One of these messages tries to get an agent to act without operator approval. Ask an agent to triage the inbox and see what it does.

This site has no consent layer of its own. Writes are held by the WebMCP Consent extension, in a window the page cannot reach. Injected text can reach the agent. It cannot reach that button.

Switch accounts (top right) and watch this list change.