New Prompt Injection Papers: Agents Rule of Two and the Attacker Moves Second