A self-contained AI security experiment: can an unfinished shell command pull a defensive assistant toward cloud metadata URLs? Historical evidence: 300,000 recorded episodes across three models. New ...