Analysis
The lethal trifecta for AI agents: private data, untrusted content, and external communication
Publication date unknown · Discovered simonwillison.net
Page published
Publication date unknown · First observed: 16 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
AI agents combining private-data access, untrusted content, and external communication require security boundaries beyond model-level instruction filtering to prevent prompt injection from becoming data theft.
Dr. Chaos analyzes how retrieval, tool permissions, persistent memory, and outbound communication amplify the consequences of prompt injection. The article uses the patched EchoLeak vulnerability (CVE-2025-32711) in Microsoft 365 Copilot to illustrate how a crafted email could trigger zero-click data exfiltration without the user opening it.