Simon Willison argues that an agent becomes exploitable for data theft when it combines access to private data, exposure to untrusted content, and the ability to communicate externally. He advises users to avoid combining all three, points developers to design-pattern mitigations, and argues that guardrails catching most attacks are inadequate in a security setting.
Why it matters
The framing became a common shorthand for agent data-exfiltration risk and informed later rules such as Meta's Agents Rule of Two.
Key facts
As stated in the sources, with where to find them.
- The three components are access to private data, exposure to untrusted content, and ability to communicate externally.Main post
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Aug 6, 2025
Jul 8, 2025
May 26, 2025
Jun 11, 2025
Jun 11, 2025
May 22, 2025