Definition
Simon Willison (2025): an agent becomes a potential data-theft machine only when all three are present: (1) access to private data, (2) exposure to untrusted content, (3) ability to communicate out (send mail, fetch a URL, post a message).
Each is useful alone; the combination is the problem, because the model canβt reliably tell which instructions come from whom. Removing one leg breaks the chain. Real instances: EchoLeak (CVE-2025-32711, zero-click exfiltration from Microsoft 365 Copilot via an auto-fetched Markdown image) and the GitHub MCP exploit (public issue β private repo β public PR).
Appears in
- Lecture 9, the lethal trifecta
- Lecture 9, EchoLeak
- Lecture 9, MCP toxic flows
- Lecture 11, Morris II: a self-replicating worm through email assistants