Post

If you use "AI agents" (LLMs calling tools in a loop) you need to be aware of the Lethal Trifecta Combine access to private data, exposure to untrusted content and the ability to externally communicate and an attacker can trick the system into stealing your data simonwillison.net/2025/Jun/16/...

This is why i believe multi agent / steps are the most effective for LLM consistency. You have one agent talking to the use and understanding the request. Another agent to run the tools get the data. Then a final agent to send the response back to the user. Trust nothing. Every prompt is an attack

I really feel like we are solving “sql injection” all over again. Sanitize the inputs…

Have you considered expanding this to three agents? A: Fetches articles, can't read them B: Reads/summarizes, zero external access C: Outputs results, never sees original content B must justify requests to both A ("why do you need these emails?") and C ("why send this data here?").

Both gatekeepers validate against project scope. If B gets compromised, it still needs to craft requests that fool two independent validators with diff contexts. "I need financial reports for CEO bday party planning" and "send to evil@hacker.com for the CEO's party" both fail obvious smell tests.

Not foolproof - we're still asking LLMs to be gatekeepers. But now a compromised B effectively needs to social engineer two independent agents. (Who could compare notes, in a sense). I reckon that's quite a bit harder to circumvent with a simple prompt injection.