As a thought experiment, would their reaction have been any different if the hidden prompt had caused their agent to enter an expensive coding loop instead of just deleting the dependency + tests? If I were to use coding agents/LLMs (I don't), this is what I'd be more concerned about...