Agent risk
The lethal trifecta: the AI agent combination to avoid
An AI agent with access to private data, exposure to untrusted content and a way to send information out can be tricked into stealing data. Removing any one of the three breaks the chain.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
The idea
Three capabilities
In a post dated 16 June 2025, Simon Willison described three capabilities that, together in one agent, let an attacker trick it into stealing data [6]. His framing is a rule of thumb, not a standard, and it is useful because it is simple to apply.
Access to private data
This is often the reason the tool exists in the first place [6]. Mail, files and customer records are all examples.
Exposure to untrusted content
Any text or images an attacker could control and feed to the model [6]. Inbound email and web pages are the usual routes.
Ability to communicate externally
A way of carrying stolen data out, which Willison calls exfiltration [6]. Sending email, making web requests and showing links are examples.
The advice
Avoid the combination
Willison's conclusion is that the only way to stay safe is to avoid the combination entirely [6]. He also argues against relying on prompt wording or guardrail products, saying that a product claiming to catch 95% of attacks is a weak standard in security [6]. The NCSC takes a similar line on filters [1].
How to apply it
Decide per tool
-
1
Write down which of the three each AI tool has. -
2
For any tool with all three, choose which capability to remove. -
3
Re-check after each new feature, connector or plug-in. -
4
Where you cannot remove one, add approval before anything leaves the organisation [4].
Where it showed up
Named examples
Willison's post names Microsoft 365 Copilot, GitHub's official MCP server, GitLab's Duo chatbot and ChatGPT among tools that have had the pattern [6]. Naming a product here is not a statement that it is unsafe today: Microsoft, for one, said it had fully addressed EchoLeak [7].
Use it as a conversation starter
Ask each supplier which of the three capabilities their product combines by default, and which you can switch off.
Next
Related reading
The EchoLeak page shows untrusted content leading to a data leak in one product, and what to ask AI suppliers turns the test into questions.
Keep reading
Read next
EchoLeak
What EchoLeak (CVE-2025-32711) was, how a crafted email could leak data from Copilot, what Microsoft said and what it teaches UK organisations.
Read the guide
AI browsers
OpenAI says prompt injection in AI browsers is unlikely to be fully solved. What that means for UK organisations that let agents browse and act.
Read the guide
Ask suppliers
A buyer's list of questions on prompt injection for AI suppliers, drawn from NCSC and OWASP advice, for UK procurement and security leads.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.