Deadly Triad

Simon Willison’s formula:

Access to private data + Exposure to untrusted content + Ability to communicate externally = Complete closed-loop attack.

Malicious instruction in untrusted content causes the agent to read private data and exfiltrate it – no further conditions required.

The fourth dimension – Persistent storage: an amplifier allowing the attack to persist between sessions.

Practical implications:

Control network egress from the sandbox – block the leakage channel more deterministically than recognizing each injection;
Do not mount credential files into the sandbox.