Picture yourself working in Antigravity, Google’s agentic editor. The agent reads a web guide with hidden text. It takes the text as an instruction and gathers code and cloud credentials. The secrets file was excluded, so the agent reads it with a terminal command. Then a browser subagent, another agent that the first one starts, opens a URL with the data inside. Its domain was allowed by default.
PromptArmor, a security company, found it, and Simon Willison wrote it up (exhibit 25). Google lists it as a known issue.
The attack is called prompt injection. It is text hidden in a page, an email or a ticket that the model reads as if it were an instruction. The agent cannot reliably tell what the user asked apart from what a document says.
Two comfortable ideas circulate around this risk. The first: if the model is well aligned and a filter catches the attacks, the rest is integration work. Aligned means trained to follow the rules of whoever operates it. The second: injection is a lab attack that rarely happens in practice.
The thesis has data, and the best of it comes from vendors. Anthropic measured its browser agent against an in-house attacker that adapts (exhibit 24). With new safeguards, the attack succeeded 1.4% of the time against Claude Opus 4.5. Without them, 7.6%.
Anthropic also has auto mode. There a classifier, a model that approves or blocks, reviews each action of its coding agent. Anthropic commissioned a third-party evaluation (exhibit 123). None of 720 indirect injections got through. Another agent with automatic review let 5.83% through, and one with full access, 19.03%. These are a vendor’s figures about its own product, but they show that a good detector can push the number way down.
0 of 720
Successful indirect injections against three Claude models in auto mode, in an evaluation commissioned from a third party. Another agent with automatic review: 5.83%; with full access: 19.03%. Exhibit 123
The second argument is cost. CaMeL is a design that separates what the user asks from the data the agent reads. A preprint, a study not yet peer reviewed, measured it in a three-agent system (exhibit 139). A CaMeL coauthor signs it. The defense cost 21.6 points of utility on average, and 13.4 in the two strongest models. Google brings patterns like these to its agentic browser, and admits that balancing security and friction is hard (exhibit 30).
Also, some teams do fine with agents that query real databases (exhibit 71, a Reddit thread). The person who allows it explains that controls were already in place: killing runaway queries and restoring a dropped table. Another team has a person review the query, and runs it under a read-only role. The security lives in the system around the model.
Designing the agent to be secure leaves it useless.
Verdict: It costs something, not everything. In a three-agent system, what the user asks was separated from the data. That cut successful attacks from 12.9% to 0.2%. It took away 21.6 points of utility on average, and 13.4 in the two strongest models. Google is already bringing patterns like these to its browser. It admits that balancing security and friction is hard.
Rule
Choose the defense to fit the task. For example, separate what the user asks from the data, or add a separate model that reviews each action. Measure how much utility you lose against how much risk you remove. If you lose little, keep the pattern.
Why medium confidence. The utility measurement comes from a preprint, a paper without peer review. One of its models rejected many benign tasks even without the defense. Google's post is by the team building the product and gives no numbers. The rule of two is a design proposal from a vendor.
Show the 4 exhibits in detailHide the detail1 for, 1 against, 2 qualify
Peters-Gill, J., Semler, A., Bartsch, H., Shumailov, I., Schroeder de Witt, C. arXiv
A co-author of CaMeL, a defense against planted instructions, shows that its guarantees do not compose on their own across agents. An instruction planted in a database is data, but the orchestrator summarizes it and another agent receives it as a trusted request. In the measurements, CaMeL in each agent cuts attack success sharply. A version that tracks data provenance across agents closes that path. The cost is usefulness, and more capable models lose less of it.
Numbers
12.9%, 0.2% and 0.0%Attack success rate without CaMeL, with CaMeL in each agent and with provenance across agents (average of 5 models, 949 cases per model and setup).
21.6 and 13.4 pointsUsefulness lost by per-agent CaMeL on 112 tasks: on average and in the two strongest models. The cross-agent version takes off another 3.2 points on average.
Limitation Preprint. One model refused 53.6% of benign tasks even without CaMeL, which lowers its baseline usefulness.
Google brings design patterns against prompt injection into a product in preview. A model that does not see untrusted web content reviews each planned action and stops the ones that do not serve the user's goal. Another rule limits which sites the agent can read and which it can act on, and a function blind to that content approves new sites. It asks the user to confirm critical steps, and Google admits that balancing security and friction is hard.
Limitation Post by the team building the product; it gives no figures. They started with a simple version of the site control to avoid adding friction.
“inspired partially by the dual-LLM pattern as well as CaMeL research”
A design rule: within one session, an agent must have at most two of these three properties. One, processing untrusted input. Two, accessing sensitive data or systems. Three, changing state (modifying something) or communicating externally. If the task needs all three, the agent must not run alone: it needs human supervision.
Numbers
2 of 3Properties an agent can combine in one session without human supervision.
Limitation On Hacker News, a co-author called it a minimum floor, not a sufficient standard. Other critics note that changing state without communicating externally can also do harm, and that asking a person to approve many actions lowers their attention.
“no more than two of the following three properties within a session”
Narisetty, P., Kore, S. N. B., Kattamanchi, U. K. R., Kumarapu, J. arXiv
It tests defenses that enforce rules outside the model, such as CaMeL or Progent. It uses an adaptive attack, which adjusts to the defense. In their reproduction, Progent sharply lowered attack success. An attack crafted by hand for that defense barely raised it. They conclude that deterministic enforcement of rules outside the model held up, although the experiment is small.
Numbers
from 25.8% to 4.2%Mean attack success on AgentDojo without and with Progent (Qwen2.5-7B, 3 runs). With the adaptive attack it stayed at 2.6%.
Limitation Preprint; the abstract was read. One weak model, a single attack type and no usefulness measurement.
Injection no longer happens only in demos. A preprint scanned 1.2 billion URLs (exhibit 94). It found 15,300 validated injections on 11,700 pages. About 70% sat in parts of the HTML a person never sees. They target search engines, support agents and hiring workflows. Small models obeyed up to 8% of the time.
Google searched the public web archive (exhibit 87). The data theft attempts were unsophisticated. But the malicious category grew 32% between November 2025 and February 2026.
Prompt injection is a lab attack: in practice it hardly ever happens.
Verdict: Not anymore. A study found 15,300 validated injections on 11,700 web pages. About 70% of them were in parts a person does not see. They target search engines, support agents and hiring workflows. Google saw the malicious category grow 32% between November 2025 and February 2026. For now the attacks are unsophisticated. Small models obeyed up to 8% of the time.
Rule
Treat everything the agent reads from outside as untrusted, including the parts of a page you cannot see. Apply the rule of two to it. Do not wait to see an attack in your logs: today's are simple, but the category is growing.
Why medium confidence. The two measurements are large and agree. But one is a preprint, a paper without peer review, read from its abstract. The other gives no absolute rates and leaves out the big social networks. NIST already names indirect injection as an example attack. Even so, in early 2026 it was only requesting information. No source measures how many injections cause real harm.
Show the 3 exhibits in detailHide the detail0 for, 2 against, 1 qualifies
Khodayari, S., Zhang, X., Acharya, B., Pellegrino, G. arXiv
The first large study of indirect injections (hidden instructions for the model) in web pages and HTTP responses. Most sit in parts a person does not see, such as headers, comments or metadata: they target machines. They aim to annoy, manipulate reputation, protect content or detect bots in search engines, support agents and hiring flows. In experiments, models comply rarely, but not zero times.
Numbers
15,300 cases in 11,700 pagesValidated injections, out of 1.2 billion URLs from 24.8 million sites. About 70% sit in HTML that is not displayed.
up to 8%Compliance of small models with plain text, in 5,200 experiments with 13 models.
Google searched the public web archive for prompt injections (hidden instructions for an AI). It found everything: jokes, "help" for agents, SEO and blocks on agents, plus a small malicious share, such as data theft. The theft attempts were unsophisticated, but the malicious share is growing and Google expects more scale soon. The attack is already on the real web, not only in demonstrations.
Numbers
32 %Relative increase in the malicious category between November 2025 and February 2026.
Limitation The archive (Common Crawl) does not include the big social networks. It gives no absolute rates.
“We did not observe significant amounts of advanced attacks”
NIST, Center for AI Standards and Innovation (CAISI)
NIST asks for public input on the security of agents that can make persistent changes outside themselves. It says its own research showed agent hijacking risks. As an example attack, it gives indirect prompt injection (hidden instructions in content the agent reads). It asks whether standard cybersecurity practices are enough for agents. It is an open consultation, not guidance: in early 2026 the US government still had no guidance for agents.
Numbers
March 9, 2026Deadline for submitting responses.
Limitation Federal Register entry (vol. 91, no. 5). The official copy on govinfo.gov was read. It is a question, not a rule; nothing is mandatory.
“has demonstrated risks of agent hijacking”
Quote checked against the original
Read at the source. Checked on Nov 2, 2026.
The hardest blow to filters comes from the paper “The Attacker Moves Second” (exhibit 8). Its authors tested 12 published defenses that claimed close to 0% attack success. With attacks that adapt to the defense, they broke most of them with over 90% success. Whoever designs a defense tests it against the attacks they know. The attacker picks an attack after seeing the defense. Willison sums it up in his comment on the paper (exhibit 13): attempts to block or filter injections have not proven reliable.
over 90%
Attack success rate against most of those defenses. Exhibit 8
Poisoned tools show the same thing. MCP is a protocol that connects agents to tools. In MCP-ITP (exhibit 41), the authors wrote tool descriptions built to evade a detector. The attack worked up to 84.2% of the time. The detector caught them at most 0.3% of the time.
Even the vendor with the best numbers admits it. In an attack exercise, the auto mode classifier let 12% of attacks through. After hardening, it let 7% through.
With a good filter or detector, prompt injection stops being a problem.
Verdict: Not as the main defense. Attacks that adapt to the defense broke 12 published defenses. Those defenses claimed nearly 0% attack success. Poisoned tools built to evade a detector were caught at most 0.3% of the time. The best favorable data come from a vendor about its own product. None of 720 injections got through in an evaluation it commissioned. But 7% got through in an attack exercise.
Rule
Use filters and detectors as an alarm, not a lock. Protection belongs in the architecture, with rules enforced outside the model. Those rules set what data the agent sees and what it can do after reading untrusted content.
Why high confidence. A paper on adaptive attacks, two preprints on tool poisoning and a specialist agree. A preprint is a paper without peer review, and these were read from their abstracts. The paper evaluates research defenses, not products. The most favorable figures are published by the vendor that sells the product. What withstood an adaptive attack was a rule outside the model, not a filter.
Show the 7 exhibits in detailHide the detail0 for, 4 against, 3 qualify
Nasr, M., Carlini, N., Sitawarin, C., et al. arXiv
Attacks that adapt to the defense break 12 published defenses against jailbreaks and prompt injection. They use gradients, reinforcement learning, random search and human-guided exploration. Most of those defenses claimed close to 0% successful attacks. Conclusion: filters and detectors do not work as the main defense.
Numbers
12 defensesPublished defenses that were tested.
over 90%Attack success rate against most of those defenses.
Limitation It evaluates defenses published in research, not specific commercial products.
Willison restates the lethal trifecta: private data, untrusted content and an outbound channel, together, make data theft possible. He admits it only covers exfiltration, and says Meta's rule of two completes it by adding state changes. On filters, he says blocking or filtering injections has not proven reliable. He does not share the optimism that adequate defenses will arrive soon.
Numbers
12 defensesPublished defenses broken by the paper The Attacker Moves Second, which the post discusses.
Limitation An opinion essay by a specialist, with no data of its own.
“attempts to block or filter them have not proven reliable enough to depend on”
Liu, S., Tang, X., Yang, X., Lin, L., Zhou, B., Xiao, W., Liu, W. arXiv
It is a benchmark in an isolated environment on MCP poisoning (MCP is the protocol that connects tools to an agent). In this attack, the tool description carries the trap. The authors say leading models such as GPT-4o are highly vulnerable. They also say that common prompt-based defenses barely help and sometimes make things worse.
Numbers
nearly 100%Attack success against GPT-4o in six high-risk scenarios, according to the abstract (32 cases, 6 categories, 8 models).
Limitation Preprint; the abstract was read, and it gives no figures for the other models.
The agent never calls the poisoned tool. Its description is enough to make the agent use another, legitimate tool with more permissions to do the damage. The authors generate those descriptions automatically. They optimize them both for the attack to work and for a detector to miss it.
Numbers
up to 84.2%Attack success on the MCPTox set, with 12 agents.
A classifier reviews each tool call instead of asking for approval for each action. It blocks what is irreversible, destructive or aimed outside the user's environment, and it always refuses data exfiltration (sending data out). If blocks pile up, it goes back to manual approval. In a study, people approved almost everything dangerous and grew tired over time. The classifier stopped far more.
Numbers
13.6% versus 89%Dangerous commands stopped by people (143 of 1,053) and that the classifier would have stopped (937 of 1,053). People drop from about 17% to about 5% after more than 50 requests.
0 of 720Successful indirect injections against three Claude models in auto mode, in an evaluation commissioned from a third party. Another agent with automatic review: 5.83%; with full access: 19.03%.
from 12% to 7%Attacks the classifier lets through in a red team exercise, before and after hardening it. The source says it is not the rate on real traffic.
6.3% versus 2.4%Sessions with an unrequested harmful action at production-level severity (7 or more), with manual approval and in auto mode. They are sessions from May and June 2026 that the safety system flagged for review, from accounts that opted in to data use.
Limitation Published by the vendor that sells the product, which also commissioned the evaluation. The attacks were optimized against a different model. The human study was in a controlled setting. There is an update note from October 22, 2026.
“it relies on classification systems and therefore does not eliminate risk”
Anthropic tests its browser agent against an adaptive internal attacker, with 100 attempts per environment. With new safeguards, the attack rarely succeeded, but not zero times. It says prompt injection, meaning instructions hidden in what the agent reads, is far from solved. It also says no browser agent is immune.
Numbers
1.4%, 7.6% and 8.0%Attack success against Claude Opus 4.5 with the new safeguards, without them and with the model alone.
2.0%, 1.9% and 2.4%With safeguards: Sonnet 4, Sonnet 4.5 and Haiku 4.5.
Limitation Published by the vendor with its own attacker; there is no independent evaluation.
Narisetty, P., Kore, S. N. B., Kattamanchi, U. K. R., Kumarapu, J. arXiv
It tests defenses that enforce rules outside the model, such as CaMeL or Progent. It uses an adaptive attack, which adjusts to the defense. In their reproduction, Progent sharply lowered attack success. An attack crafted by hand for that defense barely raised it. They conclude that deterministic enforcement of rules outside the model held up, although the experiment is small.
Numbers
from 25.8% to 4.2%Mean attack success on AgentDojo without and with Progent (Qwen2.5-7B, 3 runs). With the adaptive attack it stayed at 2.6%.
Limitation Preprint; the abstract was read. One weak model, a single attack type and no usefulness measurement.
Read at the source. Checked on Nov 2, 2026.
If the filter is not enough, the question changes: how much harm can a fooled agent do? Willison explains it with the lethal trifecta, a mix of three conditions. An agent is highly vulnerable if it has all three:
Access to private data.
Exposure to untrusted content.
A way to communicate externally.
With all three, an attacker can make it leak data. MCP-SafetyBench (exhibit 34) used real MCP servers and measured 13 models. All of them stayed vulnerable, with attack success from 29.80% to 48.16%. The models that do the task best resist attacks worst, because they also obey the attacker better.
In 2026, Microsoft kept registering injections in Copilot that disclose information over the network. Each one has a CVE, the public number of a vulnerability. Two examples are CVE-2026-24301 (exhibit 128) and CVE-2026-55946 (exhibit 132).
The way out is wider than it looks. Copilot Cowork, Microsoft’s agent, could send emails with external images to the user’s own inbox (exhibit 108). When the email opened, those network requests carried files out.
Claude Cowork, Anthropic’s desktop agent, limited outbound traffic to a list of domains. Anthropic’s API was on the list (exhibit 38). The attack uploaded the victim’s files with the attacker’s key.
In a third case, Claude followed links to spell out the user’s data, letter by letter (exhibit 118). All three cases are demonstrations by security companies or researchers.
If the agent cannot send email or call external APIs, it cannot get data out.
Verdict: It is not enough. A Microsoft agent could send emails to the user's own inbox with external images. When the email opened, those network requests carried files out. Another agent uploaded the victim's files to its own vendor's API. That API was on the list of allowed domains. A third spelled out the user's data by following links, letter by letter.
Rule
Count as an exit every network request the agent can trigger. That includes images, links, allowed domains and your own vendor's API, as well as email. Cut it with fixed rules, outside the model, and open only the destinations the task needs.
Why medium confidence. They are demonstrations by security firms, plus an official record of a Copilot flaw. Most were read on a specialist's blog rather than in the original research. They show that the channel exists, not how often it is used. No source argues that cutting email and APIs is enough.
Show the 7 exhibits in detailHide the detail0 for, 5 against, 2 qualify
Microsoft's agent could send emails to the user's own inbox without approval. Those emails could carry external images that made network requests when opened. The cloud storage builds download links that are already authenticated, so files could be exfiltrated. The attack did not need to send email outside or call external APIs: the channel was an image.
Limitation Willison's full post was read; the original research is by PromptArmor and was not opened. It is a demonstration.
Anthropic's desktop agent only lets outbound traffic go to a list of domains. Anthropic's API is on that list. The attack used the attacker's API key to upload the victim's files to Anthropic's files API. In this way, an allowed channel was used to exfiltrate data. According to PromptArmor, no user approval was needed. They showed it with Claude Haiku and say they also manipulated Opus 4.5.
Limitation The page shows no publication date; January 2026 is used, when Willison discussed it (January 14). Published by a security company. It is a demonstration, not a frequency measurement.
Claude's tool for opening web pages could only open URLs the user wrote or that search returned. A researcher found it could also follow links from pages already opened. He built a trap site that made the agent spell out data by opening links letter by letter. That way they extracted the user's name, city and employer, and Anthropic closed the hole. Even a well-designed fixed rule can have an outlet no one saw.
Limitation Willison discusses another person's research. It is a demonstration, already fixed.
Willison summarizes PromptArmor research on Google's agentic editor. A web guide with hidden text made the agent gather code and cloud credentials. The secrets file was excluded, so the agent read it with a terminal command. Then a browser subagent opened a URL with the data inside, on a domain that was on the default allow list. Google lists it as a known issue.
Limitation Willison's post was read; the original research is by PromptArmor, a security company, and was not opened. It is a demonstration, not a frequency measurement.
A command injection in Microsoft Copilot lets an unauthorized attacker disclose information over a network. It repeats the EchoLeak pattern in a commercial product, more than a year later. This attack needs the user to take an action.
Numbers
8.8 out of 10 (high)CVSS 3.1 severity; the vector requires user interaction.
Limitation Official record with a short description. In 2026, up to September, Microsoft published at least six more injection records for its Copilots, all requiring user interaction.
OpenAI launched a lockdown mode that limits outbound network requests, to cut the last step of an exfiltration. OpenAI notes that the mode does not stop the injection from reaching the content. Willison says the trifecta can only be solved by cutting one of its three legs. For him, the outbound channel is the easiest leg to cut without losing usefulness. This mode cuts it with fixed rules that no AI evaluates. He also says its existence implies that ChatGPT, by default, does not protect well against a determined exfiltration.
Limitation A short comment on an OpenAI help page; it gives no figures.
“lockdown mode directly attacks that leg, using mechanisms that are deterministic”
A design rule: within one session, an agent must have at most two of these three properties. One, processing untrusted input. Two, accessing sensitive data or systems. Three, changing state (modifying something) or communicating externally. If the task needs all three, the agent must not run alone: it needs human supervision.
Numbers
2 of 3Properties an agent can combine in one session without human supervision.
Limitation On Hacker News, a co-author called it a minimum floor, not a sufficient standard. Other critics note that changing state without communicating externally can also do harm, and that asking a person to approve many actions lowers their attention.
“no more than two of the following three properties within a session”
Quote checked against the original
Read at the source. Checked on Nov 2, 2026.
The last front is permissions. On Hacker News, a team told how a coding agent used a token with too much scope (exhibit 91). A token is a key that gives access to a system. In about 9 seconds, the agent deleted the production database and its backups. Most readers saw a permissions failure: a rule written in the prompt is not a control.
A highly upvoted comment in a Reddit security forum sums it up (exhibit 141). If an agent deleted a database, the scope was wrong before it did.
Whatever you add to the agent inherits its permissions. Snyk, which sells a security scanner, audited 3,984 skills, which are packages of instructions and code for agents. It confirmed a malicious payload in 76 (exhibit 54).
OWASP, a software security foundation, calls for least privilege per tool (exhibit 33). Least privilege means only the access the task needs. NIST, the US standards institute, calls in a draft for each agent to have its own identity (exhibit 50).
For the agent to work smoothly, it is best to give it the user's credentials or an account with broad permissions.
Verdict: No. A coding agent used a token with too much scope. In about 9 seconds it deleted a volume with the production database and its backups. Most readers saw a permissions failure, not a rogue AI. The skills added to an agent inherit all its permissions. OWASP asks for least-privilege profiles per tool: only the permission each one needs. A NIST draft asks for each agent to have its own identity.
Rule
Give each agent its own identity, tied to whoever delegates to it. Give it the least permission the task needs and credentials that cannot delete. Keep backups and safeguards out of its reach: a rule written in the prompt is not a control.
Why medium confidence. OWASP is a voluntary consensus framework and the NIST document is a draft for comment. They shape design, but measure nothing. The cases come from Hacker News and Reddit, without an independent investigation. The skills audit is published by the company that sells the scanner. No source argues for giving broad credentials.
Show the 7 exhibits in detailHide the detail0 for, 5 against, 2 qualify
A thread about a coding agent that deleted, in about 9 seconds, a volume with the production database and its backups. It used a token with too much scope, and the data was partly recovered. Most readers see a failure of permissions and backup design, not “rogue AI”. A rule in the prompt is not a control: they propose minimal credentials, backups in another account and protections outside the agent's reach.
Numbers
about 9 secondsTime of the deletion, according to the affected party's account.
860 points and 1,032 commentsSize of the thread.
Limitation The technical details are the affected party's; there is no independent investigation. It was read on news.ycombinator.com and through the public Algolia API. Quotes from the thread were not checked word by word, so none is used.
A highly upvoted comment says that if an agent deleted a database or pulled data out, the scope was already wrong before. It names what gets skipped: tokens with owner permissions and all-or-nothing tool access. There is also no log that lets anyone replay what happened. Another comment compares the liability to that of the owner of a dog off its leash.
Numbers
964 points and 80 commentsSize of the thread according to the archive. The quoted comment has 84 points.
Limitation Opinion from security practitioners, without documented cases in the thread. It was read in the public Arctic Shift archive because reddit.com blocks automated reading. The quote was compared letter by letter with the original.
“they do exactly what their tooling scope permits”
It is OWASP's first consensus list built for agents. The ten risks run from agent goal hijacking (ASI01) to rogue agents (ASI10). They include tool misuse (ASI02) and identity and privilege abuse (ASI03). They also include the agentic supply chain (ASI04) and cascading failures (ASI08). It adds the principle of least agency: do not grant autonomy that is not needed. Its mitigations include least-privilege profiles per tool, human approval for destructive actions and controls outside the model. It also asks for cost, rate or token caps with automatic cutoff.
Numbers
10 risks (ASI01 to ASI10)Size of the list. ASI02 and ASI03 extend excessive agency (LLM06) from the 2025 list to multi-step flows.
Limitation It is a voluntary consensus framework: it binds no one and measures nothing. In the agent list, unbounded consumption is no longer an item of its own: it appears as a scenario and mitigation inside ASI02. The full PDF (57 pages) was read.
“deploying agentic behavior where it is not needed expands the attack surface”
Booth, H., Fisher, B., Galluzzo, R., Roberts, J. NIST, NCCoE
It is a NIST draft for a demonstration project that applies identity standards to agents. It proposes to identify the agent as distinct from a person, and to authenticate and authorize it with OAuth 2.0 and policies. It also proposes to bind each agent to the person who delegates to it, and to log its actions. It asks how to know the sensitivity of the data the agent gathers, and whether the user may see the combined answer. It also asks how to set least privilege (only the permissions needed) when the agent's actions are not predictable.
Numbers
6 groups of questionsGeneral, identification, authentication, authorization, auditing and prompt injection. Comments from February 5 to April 2, 2026.
Limitation It is a draft for consultation, with questions rather than controls. It leaves RAG out of scope. The PDF (11 pages) was read; the project page returned 403.
“How do we establish "least privilege" for an agent”
Beurer-Kellner, L., Kudrinskii, A., Milanta, M., Nielsen, K. B., Sarkar, H., Tal, L. Snyk
It is an audit of the skills published in two open catalogs, with a scanner and human review. A skill is a package of instructions and code added to an agent. The skill inherits every permission of the agent: shell, files and credentials. Publishing takes one file and a new account, with no signing, no review and no isolation by default. Tool poisoning stops being a demonstration and is measured in a real ecosystem.
Numbers
76 of 3,984Skills with a malicious payload confirmed by people, out of those scanned. 8 were still published at the time of writing.
534 (13.4%) and 1,467 (36.82%)Skills with at least one critical issue and with any issue.
Limitation Published by the company that sells the scanner. The title speaks of 1,467 malicious payloads, but the body says 1,467 are skills with any issue and 76 the confirmed malicious ones: the base uses the body. Skills are not exactly MCP servers.
“Agent Skills operate with the full permissions of the AI agent they extend”
Those who let an agent query production databases do it because they already had controls designed for non-technical users. These controls are killing runaway queries, a warehouse with limited scale, table history and a way to recover a dropped table. Another team has the agent write the query and a person review it. Then the query runs with a read-only role. Anything that writes data goes through code review.
Numbers
53 points and 60 commentsSize of the thread according to the archive. The comment about the controls has 72 points.
Limitation Practitioner experience, without measurement. It was read in the public Arctic Shift archive because reddit.com blocks automated reading. The quote was compared letter by letter with the original.
A thread on who owns an agent six months after the person who built it leaves. One comment compares it to the old Microsoft Access databases left loose in companies. Another says agents belong to teams, not to people. The most concrete proposal is to treat them as service accounts, which are accounts for programs. That needs an inventory of what they read and write, credentials under a role and a review every three months.
Numbers
26 points and 33 commentsSize of the thread according to the archive. The quoted comment has 5 points.
Limitation A small subreddit with some vendor comments; it is useful as an idea, not as consensus. The same idea appears in other threads on r/sysadmin, r/ITManagers and r/devops. It was read in the public Arctic Shift archive because reddit.com blocks automated reading. The quote was compared letter by letter with the original.
“nothing goes live without a named owner, a backup owner, and a review date”
Alignment and filters help, but they do not hold up an agent’s security.An adapted attack gets past them, and injection is already on the real web. The architecture sets the possible damage: what the agent reads, what it touches and what it sends out in one session.
Designing this way costs something, but not everything. In exhibit 139, CaMeL on each agent cut successful attacks from 12.9% to 0.2%. One model in the study refused 53.6% of benign tasks even without a defense. So part of the lost utility was missing to begin with.
Another preprint tested rules enforced outside the model against an adaptive attack (exhibit 113). With Progent, attack success fell from 25.8% to 4.2%. The experiment is small. But what held was a rule outside the model, not a filter.
from 25.8% to 4.2%
Mean attack success on AgentDojo without and with Progent (Qwen2.5-7B, 3 runs). With the adaptive attack it stayed at 2.6%. Exhibit 113
Meta proposes a practical rule, the Rule of Two (exhibit 12). In one session, an agent combines at most two of these three properties:
Processing untrusted input.
Accessing sensitive data or systems.
Changing state or communicating externally.
If the task needs all three, the agent does not run alone. A coauthor called it a minimum floor. And a person who approves many actions stops paying attention, as chapter 7 shows.
Fixed cuts on outbound traffic complete the rule, like OpenAI’s lockdown mode (exhibit 110). Willison says the outbound leg is the easiest one to cut without losing utility.
No source measures how many injections cause real harm. For design, it is enough to know that the path exists.
If the model is well aligned, it can read private data, process outside content and communicate externally, all at once.
Verdict: No. With all three together, an attacker can make the agent leak data. The model's alignment does not prevent it. A web guide with hidden text made an agentic code editor gather code and credentials. Then the editor sent them out. In a benchmark with real MCP servers, the models that do the task best resist attacks worst. In 2026, Microsoft kept recording injections in Copilot that allow information to be disclosed over the network.
Rule
Apply the rule of two: within a single session, the agent combines at most two of three properties. They are reading untrusted content, touching sensitive data or systems, and acting or communicating externally. If the task needs all three, remove one or add human approval.
Why high confidence. Two official records of flaws in a commercial product, a benchmark with real servers, demonstrations and a specialist agree on the mechanism. The benchmark has only 13 models, and the demonstrations show the attack is possible, not how often it happens. No source argues that alignment is enough.
Show the 8 exhibits in detailHide the detail0 for, 5 against, 3 qualify
Willison restates the lethal trifecta: private data, untrusted content and an outbound channel, together, make data theft possible. He admits it only covers exfiltration, and says Meta's rule of two completes it by adding state changes. On filters, he says blocking or filtering injections has not proven reliable. He does not share the optimism that adequate defenses will arrive soon.
Numbers
12 defensesPublished defenses broken by the paper The Attacker Moves Second, which the post discusses.
Limitation An opinion essay by a specialist, with no data of its own.
“attempts to block or filter them have not proven reliable enough to depend on”
Willison summarizes PromptArmor research on Google's agentic editor. A web guide with hidden text made the agent gather code and cloud credentials. The secrets file was excluded, so the agent read it with a terminal command. Then a browser subagent opened a URL with the data inside, on a domain that was on the default allow list. Google lists it as a known issue.
Limitation Willison's post was read; the original research is by PromptArmor, a security company, and was not opened. It is a demonstration, not a frequency measurement.
A benchmark (a standard test set) with real MCP servers in five domains: browser, finance, maps, repositories and web search. It tests 20 attack types on the server, host and user side. Every model tested is still vulnerable, and the ones that do the task best resist attacks worst.
Numbers
from 29.80% to 48.16%Attack success rate across 13 models and 245 cases (GPT-5: 37.55%; Claude 4.0 Sonnet: 31.43%).
r = -0,572Correlation between task success and defense (p = 0.041, with only 13 models).
Limitation Preprint. There is a version 2 (March 5, 2026) that does not say what changed; the figures are from version 1. 2025 models. Task success is low (9% to 21%).
“models with higher task performance tend to be less resistant to attacks”
A command injection in Microsoft Copilot lets an unauthorized attacker disclose information over a network. It repeats the EchoLeak pattern in a commercial product, more than a year later. This attack needs the user to take an action.
Numbers
8.8 out of 10 (high)CVSS 3.1 severity; the vector requires user interaction.
Limitation Official record with a short description. In 2026, up to September, Microsoft published at least six more injection records for its Copilots, all requiring user interaction.
A design rule: within one session, an agent must have at most two of these three properties. One, processing untrusted input. Two, accessing sensitive data or systems. Three, changing state (modifying something) or communicating externally. If the task needs all three, the agent must not run alone: it needs human supervision.
Numbers
2 of 3Properties an agent can combine in one session without human supervision.
Limitation On Hacker News, a co-author called it a minimum floor, not a sufficient standard. Other critics note that changing state without communicating externally can also do harm, and that asking a person to approve many actions lowers their attention.
“no more than two of the following three properties within a session”
OpenAI launched a lockdown mode that limits outbound network requests, to cut the last step of an exfiltration. OpenAI notes that the mode does not stop the injection from reaching the content. Willison says the trifecta can only be solved by cutting one of its three legs. For him, the outbound channel is the easiest leg to cut without losing usefulness. This mode cuts it with fixed rules that no AI evaluates. He also says its existence implies that ChatGPT, by default, does not protect well against a determined exfiltration.
Limitation A short comment on an OpenAI help page; it gives no figures.
“lockdown mode directly attacks that leg, using mechanisms that are deterministic”
Peters-Gill, J., Semler, A., Bartsch, H., Shumailov, I., Schroeder de Witt, C. arXiv
A co-author of CaMeL, a defense against planted instructions, shows that its guarantees do not compose on their own across agents. An instruction planted in a database is data, but the orchestrator summarizes it and another agent receives it as a trusted request. In the measurements, CaMeL in each agent cuts attack success sharply. A version that tracks data provenance across agents closes that path. The cost is usefulness, and more capable models lose less of it.
Numbers
12.9%, 0.2% and 0.0%Attack success rate without CaMeL, with CaMeL in each agent and with provenance across agents (average of 5 models, 949 cases per model and setup).
21.6 and 13.4 pointsUsefulness lost by per-agent CaMeL on 112 tasks: on average and in the two strongest models. The cross-agent version takes off another 3.2 points on average.
Limitation Preprint. One model refused 53.6% of benign tasks even without CaMeL, which lowers its baseline usefulness.
An agent’s security is designed into what it sees and does, not into what the model promises. For each agent you run or plan to launch:
Build its threat map. Write down what untrusted content it reads, what sensitive data it touches and through which channels it can send something out.
Treat everything it reads from outside as untrusted. Include the parts of a page that nobody sees.
If it has all three properties in the same session, remove one. If you cannot, add human approval for what goes out.
Count as outbound every network request from the agent: images, links, allowed domains and your vendor’s API. Cut it with fixed rules.
Give it its own identity with the least privilege the task needs. Keep backups out of its reach.
Use filters and detectors as an alarm, not as a lock.
The action policy sorts what the agent does alone, what a person confirms and what is forbidden. The evaluator tells you if a fixed workflow is enough, and a fixed workflow leaves fewer doors open.