One website was enough to hijack Microsoft’s AI agent