Agents are useful because they follow instructions and read whatever a task puts in front of them, from web pages to emails to shared files. Together, those 2 strengths create one of the most serious security problems in agent design. Text written by a stranger can slip into an agent's work and give it orders, and the agent often can't tell those orders apart from yours.

That flaw, called prompt injection, still has no reliable fix. Hidden instructions have turned up in emails, web pages, calendar invites, and even tool descriptions, often in places no person would think to look. Security researchers have, however, pinned down when injection turns into theft: an agent that can reach private data, reads untrusted content, and can send information out can be turned against the very person it works for.

Smarter models lower the odds of an attack working, but none bring them to zero, and attackers keep adapting. Closing one exit at a time doesn't hold for long either, because attackers simply find the next one. The dependable defense is structural. Make sure no single agent session holds all 3 ingredients at once, and check for the combination every time a new tool or connection gets added.

Prompt injection

Prompt injection

Prompt injection is an attack where text inside the content an agent reads gives the agent new orders. The person's request and the material the agent is working on, such as a web page or an email, reach the AI model as one stream of text, and the model can't reliably tell which part is the request and which part is just data. Most agents run on a large language model (LLM), and the UK's National Cyber Security Centre puts the problem plainly: "Under the hood of an LLM, there's no distinction made between 'data' or 'instructions'." [1]

The problem was first publicly demonstrated in September 2022, when Riley Goodside showed GPT-3 abandoning a translation task because the text it was asked to translate told it to do something else. Simon Willison named the attack prompt injection the next day [2]. In 2023, Kai Greshake and colleagues described the version that matters most for agents, indirect prompt injection, where the attacker never talks to the AI at all and instead plants instructions in content it will read later [3].

Prompt injection isn't the same as jailbreaking. A jailbreak tricks a model into breaking its own safety rules. Prompt injection hijacks the app or agent built on top of the model, and the person who gets hurt is usually its user [4]. OWASP, a nonprofit that tracks software security risks, ranks prompt injection as the top risk for apps built on language models [5].

Where injected instructions hide

Injected instructions can ride in on anything an agent reads. Anthropic's Claude Opus 5.5 system card, published in September 2026, describes the attack simply: "In a prompt injection attack, an attacker hides an instruction within content an agent will process during a task." [6]

Documented cases show the range:

  • Email: in EchoLeak, a single email to a Microsoft 365 Copilot user carried instructions phrased as advice to the human reader (reported January 2025, fixed June 2025) [7]
  • Web pages: Brave researchers hid instructions behind a Reddit spoiler tag, and asking Perplexity's Comet browser to summarize the page was enough to trigger them (August 2025) [8]
  • Calendar invites: instructions in event titles hijacked Google's Gemini assistants when a person later asked about their schedule (August 2025) [9]
  • Tool descriptions: instructions placed in a connector's description of its tools were "invisible to users but visible to AI models" (April 2025) [10]

Most of these were invisible or disguised: white text on a white background, spoiler tags, faint text inside images that fired when Comet read a screenshot [11], or tool details the app never displays. The calendar attack didn't even need the person to open anything. Attackers don't have to pick a victim either, since "the same email sent to a thousand inboxes will compromise every agent that summarizes the text." [12]

Pro Tip! Text pasted into a chat counts as untrusted content too, since a copied web page or forwarded email can carry hidden instructions.

The lethal trifecta

The lethal trifecta

The lethal trifecta is the combination that turns prompt injection into data theft. Simon Willison named it on 16 June, 2025 [13]. An agent is at risk when it has all 3 legs at once:

  • Access to private data, such as an inbox, personal files, or company documents
  • Exposure to untrusted content, meaning anything a stranger could have written, from a web page to an incoming email
  • A way to communicate externally, so information can leave the agent's hands

Prompt injection is the underlying flaw, and the trifecta is the condition that makes it costly. Untrusted content lets an attacker slip in orders, private data gives the attacker something worth taking, and outside communication gives it a way out. With all 3 in one agent, a single hidden instruction can tell the agent to gather private information and pass it to the attacker.

The trifecta doesn't require a broken or malicious agent. It describes one that works as designed and follows instructions too well. Willison puts the problem with language models this way: "The problem is that they don't just follow our instructions. They will happily follow any instructions that make it to the model." [14] Anthropic now uses nearly the same test in its own safety reports: "Any agent that is exposed to untrusted data, and can both read private data and take action on the user's behalf, is exposed." [15]

How data leaks out

The third leg is the easiest to underestimate. Any way an agent can reach the outside world can carry stolen information with it, not just sending email. Willison's list includes making a web request, loading an image, and even offering a link for a person to click [16]. Each of these contacts another computer, and that contact can carry data along with it.

Documented exits include:

  • An image the app loaded automatically, with no click from the person (EchoLeak, June 2025) [17]
  • A public pull request, a proposed change to a shared code project, opened by a coding agent through GitHub's connector (May 2025) [18]
  • A reply posted to a Reddit thread by Perplexity's Comet browser (August 2025) [19]
  • An upload to Anthropic's own servers, one of the few destinations Claude Cowork allowed (January 2026) [20]

Willison notes that vendors usually fix each report by "locking down the exfiltration vector." [21] That means closing one particular exit, since exfiltration is the security term for sneaking data out. The exits keep getting subtler, from images and links in 2025 to trusted vendor addresses and chains of links followed one after another in 2026 [22]. Closing one exit doesn't mean every exit is closed.

Remove one leg

No filter reliably catches injected instructions, so the dependable defense is structural: make sure no single agent session, one run of the agent with its current context, has all 3 legs. Willison's verdict is blunt: "The only way to stay safe there is to avoid that lethal trifecta combination entirely." [23] He calls the outside-communication leg the easiest one to remove [24].

Vendors have done this in real products. OpenAI's Atlas browser, retired in August 2026, shipped in October 2025 with a logged-out mode that let the agent work without the person's accounts, taking away the private-data leg [25]. In July 2026, after a researcher showed Claude's web-fetching tool could be steered through links inside pages it had already read, Anthropic removed that ability and cut a communication route [26]. Each fix trades away some convenience for a leg attackers can't use.

Removing a leg stops data theft, not every harm. In an undefended test of Claude for Chrome in August 2025, a fake "security team" email told the agent to delete a person's emails, and it did [27]. Nothing was stolen, yet untrusted content plus the power to change things still caused damage. Meta AI's "Agents Rule of Two" (October 2025) covers this gap by widening the third leg: an agent should combine no more than 2 of untrustworthy inputs, sensitive data, and the ability to change things or communicate externally [28]. In practice, a leg gets removed through permissions, sandboxes, and approvals.

Spotting the trifecta

Spotting the trifecta

Checking any agent setup for the trifecta comes down to 3 questions. What private data can it reach? What content from strangers will it read? How could it send something out? If all 3 have an answer within the same session, the setup has the trifecta.

Meta AI's Rule of Two post shows the check at work with 3 example agents, each designed to drop one leg[29]:

  • A travel assistant reads outside websites and holds the traveler's details, so a person confirms before it books or sends anything
  • A web research agent browses freely and can send results out, so it runs in a sealed-off space with no private data
  • An internal coding agent can reach company code and make changes, so it only reads sources the company trusts

The trifecta usually appears by accident. Each connection looks harmless on its own: an inbox, a web browser, a messaging app. Willison warns that MCP, the standard for plugging tools into agents, encourages people "to mix and match tools from different sources" [30]. That's how one new connection can quietly complete the set. The risk lives in the combination, not in any single tool.

Limits of smarter models

Better models help a lot, but they don't make prompt injection go away. Labs now train models to recognize and ignore injected instructions, and the gains are real. In its Claude Opus 5.5 system card (22 September, 2026), Anthropic reported attacks succeeding 0.09% of the time in its browser-use tests, and 0% with its extra safeguards on. In a coding test against an adaptive attacker, one that keeps changing tactics, the same model was attacked successfully 54.61% of the time unprotected and 11.13% with safeguards [31].

Those figures depend on where the agent works and who's attacking, so they don't form a simple trend line. Capability doesn't guarantee resistance either. In the browser test in Anthropic's July 2026 Claude Opus 5 system card, the frontier model Claude Mythos 5 was attacked successfully 29.7% of the time, compared with 0.93% for Claude Sonnet 5 [32].

Defenses also face attackers who adapt. In October 2025, researchers from OpenAI, Anthropic, and Google DeepMind bypassed 12 published defenses, most at success rates above 90% [33]. In December 2025, OpenAI said that prompt injection, much like online scams, is unlikely ever to be fully solved [34]. Willison explains why a high catch rate still falls short: "in web application security 95% is very much a failing grade." [35] A more robust model lowers the risk, but removing a leg is what stops the theft.