AI Agents vs. Security: SQLi Success, Control Failures