What attack vectors should AgentInterdict cover next?

I built AgentInterdict to secure the boundary where an AI agent's context becomes action — stopping prompt injection, credential leakage, memory poisoning, and authority spoofing before they can cause a breach.

I benchmarked it against 200 real injection attempts and published the results honestly: 96.5% block rate, 7 documented misses (I publish the misses rather than claim 99.9% — a security tool that hides its failures isn't trustworthy).

The 7 misses are the gaps I care about most. They break down roughly as:
 - multi-turn / conversational injection that spans several exchanges
 - obfuscation techniques I haven't seen yet
 - edge cases in tool-call semantics

So here's the question for this thread: what attack vectors or evasion techniques would you want an agent-security runtime to handle next?

Whether you're building agents, running local LLMs, or thinking about this from a security perspective — I want the hard cases. What am I missing?

Open-source, local-first, free for personal/research use: github.com/BryanFiFife/AgentInterdict