THE LIVING ATLAS
Back to the discovery

Source record · 2025

The lethal trifecta for AI agents: private data, untrusted content, and external communication

Simon Willison

Read the original Publication page
Type
Developer security analysis
Publication
Simon Willison’s Weblog
Version used
Published source; consulted 23 October 2026
Source date
16 June 2025
Recorded in Atlas
23 October 2026
License
Linked and paraphrased; copyright remains with the source.

A security model for a specific combination of capabilities. It is not a claim that every agent or every current product is compromised. No separate validity period has been established for the finding.

How Atlas uses this source

Check an AI-drafted reply

The three capabilities and indirect prompt-injection risk

A security model for a specific combination of capabilities. It is not a claim that every agent or every current product is compromised.

Open the source passage
Supports this claim:Connections change what a mistake can do