The lethal trifecta is the product, not the bug: cap your agents at two of three

A native article published by SC World makes an argument worth taking out of the vendor register and into the change-control meeting: an agent that reads your data, ingests outside context and takes action is not misconfigured, it is doing the job it was bought for, and that combination is exactly what makes indirect prompt injection work ^[1][7][8]. If that is right, the deliverable stops being a filter that blocks the attack and becomes a ceiling on what a compromised agent can touch ^[13][14].

The mechanism is dull, which is why it keeps working. An attacker plants instructions in content the agent reads on the user's behalf - an email, a web page, a document - and the agent executes them with the user's privileges while the user sees nothing ^[3]. Simon Willison's framing, cited in the piece, calls the dangerous combination the lethal trifecta: private data access, untrusted content processing and external communication in one process ^[2]. The Agents Rule of Two generalises it into something you can actually put in a design review: an agent should satisfy at most two of processing untrusted input, accessing sensitive systems, and changing state externally ^[4]. Two of three is a budget, not a slogan, and the article is candid that the capabilities practitioners want push firmly outside it, and that over-constrained pilots fail on effectiveness ^[5][6].

On evidence, the piece is measured. The most cited attacks remain research demonstrations and proofs of concept ^[9]. But it reports that Google's April 2026 study of the Common Crawl repository found injections embedded in public web pages ranging from pranks to SEO manipulation to data exfiltration attempts, with a 32% increase in malicious attempts between November 2025 and February 2026 ^[10] - roughly a three-month window ^[11]. No enterprise-scale public catastrophe has landed yet, which the author treats as a warning period rather than an all-clear ^[12].

The reason blast radius is the live control is that the other two lines are not available. Prevention - input filtering, instruction hierarchy, fine-tuned classifiers - collapses under adaptive attack: the article cites Nasr et al testing 12 theoretical defenses, with human red-teamers achieving a 100% bypass rate, meaning none of the 12 held ^[15][16][17]. Architectural separation is the better answer and does not ship. CaMeL, from Google DeepMind, has the right shape, with the model proposing actions and a deterministic policy engine outside the model deciding whether to execute them, alongside Willison's Dual LLM pattern and a six-pattern paper from IBM, ETH Zurich, Google and Microsoft ^[18][19][20]. Per the article, no production-grade CaMeL implementation currently exists, and no mainstream harness - Claude Code, Cursor, Hermes, GitHub Copilot Agent, Gemini CLI - has adopted these patterns ^[21][22].

That leaves the third line: assume the model is compromised and contain it with controls that sit outside the model, namely process boundaries, credential isolation, egress filtering, human gates and comprehensive audit ^[13][14]. Every one of those is a mechanism a security team already owns and can evidence. None of them require the model to behave.

What to watch. Whether the seven tactical patterns the author promises for the next one to six months are genuinely harness-independent, or quietly assume tooling that does not exist ^[23]. Whether any mainstream harness ships a policy engine outside the model, which would move the ceiling from process design back into the product ^[21][22]. And whether the next Common Crawl measurement extends the November-to-February trend, since industrialisation, not novelty, is what turns a research demonstration into an incident queue ^[10][12].