Deadly Triad

Simon Willison’s formula: access to private data + exposure to untrusted content + ability to communicate externally = complete closed-loop attack. Malicious instruction in untrusted content causes the agent to read private data and transmit it outwards – no further conditions required. The fourth dimension – persistent memory: an amplifier allowing the attack to persist between sessions. Practical implications: control network egress from the sandbox (block the leakage channel more deterministically than recognizing each injection), do not mount credential files into the sandbox.

Related: [Prompt Injection], [Guardrails], [Agent Loyalty]