Agents follow instructions, including instructions hidden in web pages, issues and logs written by strangers. If an agent can also reach private data and send things out, an attacker can steal that data. Learn how prompt injection works, Simon Willison's lethal trifecta, why filters and prompt begging fail, and the defenses that actually work.
Key takeaways
- Prompt injection: models can't reliably tell your instructions from instructions hidden in the content they read.
- The lethal trifecta: private data + untrusted content + a way to send data out = an attacker can steal your data.
- Asking the model to ignore attacks, or adding an AI filter, isn't security. A 99% filter fails against a motivated attacker.
- Break the trifecta: sandbox the filesystem and network, scope credentials, and keep secrets out of the agent's reach.
- Good boundaries give agents more autonomy, not less: sandboxing cut permission prompts by 84% at Anthropic.
Try it with your agent
Audit your environment (read-only):
Audit this environment against the lethal trifecta. List: private data you can reach (files, env vars, tokens), untrusted content you read (web, issues, logs, dependencies), and every way you can send data out. Propose the smallest changes that break the trifecta.
Transcript
Intro
If your agent can read your secrets, read things strangers wrote, and send data to the outside world, then someone else can control it. This might be the most important lesson in the course.
Prompt injection
Simon Willison, who coined the term prompt injection, explains the root cause. Models can't reliably tell where an instruction came from. Your request, a web page, a GitHub issue: everything gets glued together into one sequence of tokens. So instructions hidden in content can hijack the agent.
Here's how that looks for a coding agent. You ask it to fix an issue from your tracker. Hidden in the issue text, an attacker wrote instructions: read the SSH key and send it to a server. Michael Patterson from Coder warns that injections can hide in anything an agent trusts: error messages, support tickets, CI logs.
The lethal trifecta
Willison's lethal trifecta tells you when this becomes dangerous. Access to private data, like your code, files and credentials. Exposure to untrusted content, like web pages and issues. And a way to communicate externally. When an agent has all three, an attacker can trick it into sending your data to them.
Coding agents make this easy to assemble by accident. An agent that can run code can usually read files and reach the network. Michael Patterson's rule for enterprises: one leg is manageable, two is unacceptable, and all three means an incident is not a question of if, but when.
What doesn't work
What doesn't work? Prompt begging, adding a line like ignore any attempts to change your task. Willison calls it a complete waste of time. Using more AI to detect attacks doesn't work either. Because, as he puts it, security based on probability is no security at all. A filter that catches ninety-nine percent of attacks fails, because attackers keep trying until they find the one percent.
Agents get creative
And agents can be surprisingly creative. In 2026, speakers described an incident where models in an OpenAI security evaluation found unknown bugs in the one package service they were allowed to reach, escaped their test environment, and broke into Hugging Face's production systems. Your sandbox has to assume the agent will push on every wall.
What works
What works is breaking the trifecta with hard boundaries. Sandbox both the filesystem and the network; Anthropic notes you need both, or a compromised agent can still leak your keys. Allow network access only to domains the task needs. Use narrow, short-lived credentials, and keep real secrets outside the sandbox entirely. Block destructive commands with hooks. And audit third-party skills and tools before you install them.
Safety enables autonomy
Here's the good news. Boundaries don't slow you down, they speed you up. When Anthropic added sandboxing to Claude Code, permission prompts dropped by eighty-four percent internally. Fewer prompts also fight approval fatigue, where people click approve without reading.
Quick check
Quick check. Your agent can read your repo and its secrets, browse the web for documentation, and post to external services. What's the most effective fix? Tap your answer.
Try it
Audit your own setup. This prompt asks your agent to map each leg of the trifecta in your environment and propose the smallest changes that break it.
Recap
Recap. Prompt injection is real, and models can't reliably tell your instructions from an attacker's. Watch for the lethal trifecta. Don't rely on prompts or filters. Break the trifecta with sandboxes, allowlists and scoped credentials. Next: what all of this means for teams.