Post

Simon Willison
@simonwillison.net

If you use "AI agents" (LLMs calling tools in a loop) you need to be aware of the Lethal Trifecta Combine access to private data, exposure to untrusted content and the ability to externally communicate and an attacker can trick the system into stealing your data simonwillison.net/2025/Jun/16/...

simonwillison.netThe lethal trifecta for AI agents: private data, untrusted content, and external communicationIf you are a user of LLM systems that use tools (you can call them “AI agents” if you like) it is critically important that you understand the risk of …
eikendev
@eikendev.bsky.social

I'm curious what "prepared statements" will eventually look like in LLM world. Having an agent check for injections in another agent's output feels more like the equivalent of sophistically checking the output of a "normal" SQL query, no? Will we need new LLM architectures to fully eliminate it?

Simon Willison
@simonwillison.net

That's still the million dollar question - we have a version of that now in the separation of system prompts from regular prompts but it's leaky - the regular prompts can still override the system prompt if they try hard enough

0 reposts2 likes

Armin Ronacher
@mitsuhiko.at

And they will have to. You could not read a "chose your own adventure book" otherwise. Following instructions as they come up is a natural behavior of what agents have to do.

eikendev
@eikendev.bsky.social

Agreed. I think what I'm asking is if and how we will eventually be able to really enforce guardrails for these adventures on LLM-level. In a way that also makes it sufficiently safe to use at scale.