qvib.pro
RU

Agent security: prompt injection

What for: understand the top unsolved agent threat - malicious text hidden in tools or data hijacks the agent and its permissions.

профи

«Lethal trifecta» — Simon Willison, 16.06.2025; эксплойты против M365 Copilot, GitHub MCP, GitLab Duo checked 2026-06-01

Updated: 02.07.2026

Agent security: prompt injection

What it is

The main class of agent vulnerabilities is prompt injection: an LLM executes instructions from any text that lands in its context, without telling a "user command" apart from "an attacker's command hidden in the data". Simon Willison coined the "lethal trifecta" - the combination of three capabilities that makes the attack trivial.

The three components of the trifecta:

  1. Access to private data (the agent reads mail, documents, databases).
  2. Exposure to untrusted content (emails, other people's docs, web pages).
  3. The ability to send data out (call an API, render an image by URL, generate a link).

Once all three come together, an attacker can use an injection in the data to exfiltrate private data.

Where it came from

  • 16 June 2025 - Simon Willison publishes "The Lethal Trifecta for AI Agents".
  • Summer 2025 - a series of real exploits: Microsoft 365 Copilot, the official GitHub MCP server, GitLab Duo and others.
  • Meta releases the "Agents Rule of Two" framework, inspired by the trifecta.

Why it's critical right now

  • MCP encourages mixing tools from different sources - which means accidentally assembling all three conditions of the trifecta.
  • The research converges on this: prompt injection is an unsolved problem; filters and blocklists aren't reliable enough.
  • The more autonomous the agent (computer use, background tasks), the higher the stakes of a mistake.

How to defend yourself

  1. Break the trifecta: never combine private data + untrusted content + an outbound channel at the same time.
  2. Read-only wherever writes aren't needed; irreversible actions only with human confirmation.
  3. Isolate the agent (sandbox), restrict sub-agents' tools, log the actions.

What to watch out for

  • "We added an injection filter" does not count as reliable protection; rely on a permissions architecture, not on a filter.
  • The danger isn't only in code but in data: a malicious instruction can arrive in an issue, an email or on a web page.
  • The MCP server supply chain is a separate vector: install only what you've vetted.

Читать по-русски →