The lethal trifecta makes agents exploitable

An AI agent (see: agent actions and planning must be observable) becomes exploitable the moment it combines three capabilities: access to private data, exposure to untrusted content, and a way to externally communicate. An attacker who can inject instructions into content the agent reads (a web page, an email, a document) can trick it into retrieving private data and sending it to an external endpoint. LLMs cannot reliably distinguish trusted instructions from untrusted data; everything arrives as tokens.

This is not a theoretical risk. It has been demonstrated against production systems including Microsoft Copilot, GitHub’s MCP (see: MCP is a protocol layer that decouples tools from providers) server, GitLab Duo, Slack AI, and dozens more. The vulnerability pattern is always the same: malicious instructions hidden in content the agent processes cause it to exfiltrate data. The fixes are always reactive (locking down the exfiltration vector), not preventive.