{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/meta-agents-rule-of-two-2025/",
 "asOf": "2026-09-26",
 "id": "meta-agents-rule-of-two-2025",
 "date": "2025-10-31",
 "datePrecision": "day",
 "title": "Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact",
 "lane": "defense",
 "kind": "framework",
 "summary": "Meta proposes that, within a session, an agent should have at most two of three properties: processing untrustworthy inputs, accessing sensitive systems or private data, and changing state or communicating externally. If all three are needed, the agent should not act autonomously and needs human approval or other validation. Meta illustrates this with travel, research and internal coding agent examples.",
 "whyItMatters": "It turns the lethal trifecta idea into an explicit design rule that a major platform company endorses.",
 "actors": [
  "meta"
 ],
 "topics": [
  "prompt-injection",
  "data-exfiltration"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "human-approver"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://ai.meta.com/blog/practical-ai-agent-security/",
   "publisher": "Meta AI",
   "title": "Agents Rule of Two: A Practical Approach to AI Agent Security",
   "date": "2025-10-31",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Properties: [A] untrustworthy inputs, [B] sensitive systems or private data, [C] changing state or external communication; satisfy no more than two per session.",
   "locator": "Framework section"
  }
 ],
 "significance": 3,
 "fideQuestions": [
  "FID-076"
 ],
 "methods": [
  "capability-restriction",
  "human-approval",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}