The dangerous combination: data, input and actions

Agents read your email, your repos and the web, and more and more often they’re allowed to do things themselves. That means a stranger who can only send an email or an issue can make your agent work for them.

After this lesson you have: a score from 0 to 3 for your own agent setup, and you know which leg to remove to make it safe.

The three ingredients

Simon Willison described the lethal trifecta in June 2025. In October 2025 Meta turned it into the Agents Rule of Two: at most two of the three per session.

	Willison (trifecta)	Meta (Rule of Two)	Examples
A. Input	“Exposure to untrusted content”	“can process untrustworthy inputs”	email, web pages, issues, PDFs, calendar invites
B. Data	“Access to your private data”	“access to sensitive systems or private data”	inbox, private repos, files, API keys
C. Action	“ability to externally communicate”	“can change state or communicate externally”	send email, open a PR, load a link, delete a file

flowchart LR
  AV["Attacker"] -.->|"plants instruction in<br/>email, issue or web page"| A["A. Untrusted input"]
  A --> AG(("Agent"))
  B["B. Private data<br/>inbox, repos, keys"] --> AG
  AG --> C["C. External action<br/>email, PR, link, API call"]
  C -.->|"data reaches<br/>the attacker"| AV

The model can’t reliably tell instructions and data apart. Willison: “we still don’t know how to 100% reliably prevent this from happening”. Your only real brake is breaking the circle.

Meta is stricter than Willison. For Meta, changing state also counts as leg C: deleting, paying, deploying. That doesn’t have to go outside to do damage. In April 2026 a Cursor agent wiped PocketOS’s production database plus backups in 9 seconds, with a token that was allowed “any operation”.

Two real examples

Incident	A. Input	B. Data	C. Action
GitHub MCP (Invariant Labs, May 2025)	an issue in a public repo	private repos via an overly broad token	a new PR in the public repo
EchoLeak (Aim Security, Jun 2025, CVE-2025-32711, CVSS 9.3)	an ordinary email in Outlook	Microsoft 365 Copilot searched email and SharePoint	data out in a URL, without a click

GitHub MCP wasn’t down to a bug: “a fundamental architectural issue that must be addressed at the agent system level” (Invariant). Microsoft has fixed EchoLeak; no exploitation in the wild has been reported.

Score your own setup in 2 minutes

Take one agent or chat assistant with connections, and answer one question per leg. Every “yes” is one point.

Question	Yes if…
A. Does it read anything a stranger can write?	email, web search, issues/PRs, shared documents, calendar, messages in Telegram or WhatsApp
B. Can it access anything that isn’t public?	your inbox, private repos, your drive, .env files, a logged-in browser
C. Can it send something out or change something?	send emails or messages, post PRs or comments, load URLs or images, shell with network, delete files

• 0-1: fine.
• 2: okay, but make sure you don’t unknowingly connect the third (a new MCP server or skill).
• 3: remove one leg today.

Pitfall

A coding agent with shell and network almost always scores 3. It reads READMEs and issues (A), sees your code and keys (B) and can run curl (C).

Three ways to remove a leg

1. Remove input (A). Let the agent read only your own, trusted sources. Does it still need to process an email or web page? Have a separate session without tools and without data make a short summary of it, and pass on only that.
2. Remove data (B). Give the agent its own, limited account or token: one repo with a fine-grained token, a separate mailbox, no ~/.ssh or ~/.aws within reach. Invariant recommends: one repo per session.
3. Remove external action (C). Close off the network, except for a short allowlist. Codex runs with “network access turned off” by default. In the Claude Code sandbox, sandbox.network.allowedDomains starts empty. Don’t give it the right to email or post on its own, or always have it confirmed by you.

Do you really need all three? Then Meta wants oversight, such as a human approving actions, or a new session in which the untrusted input is no longer present.

Loading an image or link is also 'external'

For leg C you think of sending email. But an agent or chat that loads an image or link sends whatever is in that URL to the server behind it. That’s exactly how EchoLeak leaked: via URLs, without anyone clicking. So also check whether your assistant automatically fetches links, previews or images.

Don't put a domain on your allowlist that anyone can write to

An allowlist with only github.com or your AI provider’s API feels safe, but an attacker can put something there too: a gist, an issue or an upload to their own account. In October 2025 Johann Rehberger got Claude to upload data to the attacker’s account this way via api.anthropic.com, an allowed domain. Preferably put only package registries and your own services on your allowlist.

Security

Think your agent has been hijacked (strange emails, PRs or uploads)? Do this in the first 15 minutes:

• Stop the session and turn off the agent, including scheduled tasks.
• Revoke the tokens it had: GitHub token, email connection (revoke OAuth access in your account), API keys. Only create new ones once the setup has been changed.
• Check what went out: sent emails, new PRs, comments and gists, and the agent’s tool log. If personal data is involved, the GDPR’s 72-hour notification duty applies.
• Remove a leg before you turn it back on. What an attack looks like, you’ll read in prompt injection in practice.

Checklist

0/5

• I scored my main agent on A, B and C
• With a score of 3, I removed one leg
• My agent uses its own, limited token instead of my main account
• Network is closed or on a short allowlist without domains anyone can write to
• Sending, posting and deleting always ask for my confirmation

Your progress is only stored in this browser.

Test yourself

1. 1Your agent reads your inbox and may send emails. Which legs does it have?

   Only B (data)B and CA, B and C: your inbox also contains email from strangers

2. 2What makes Meta's Rule of Two stricter than the trifecta?

   Leg C also includes changing state, such as deleting or payingIt bans all agents with internet accessIt only applies to companies

3. 3Which measure removes leg C?

   Putting in the system prompt that the agent must not leak anythingNetwork closed except for a short allowlist, and no right to email on its ownChoosing a stronger model

Next lesson: prompt injection in practice. What such an attack looks like and how to configure your agent.