An agent becomes a potential data-theft machine only when all three are present at once. Each is individually useful; the combination is the problem.

• Access to private data. Often the whole point of the agent's tools.
• Exposure to untrusted content. Any text or image an attacker can get in the model's context window.
• Ability to communicate out. An exfiltration channel: send mail, fetch a URL, post a message.

This motivates system-level defenses covered later.