{"slug": "agents-need-the-internet-and-that-is-the-problem", "title": "Agents need the internet, and that is the problem", "summary": "Simon Willison's 'lethal trifecta' describes the three conditions required for prompt injection attacks against AI agents: access to valuable data, exposure to attacker-controlled content, and a data exfiltration path. The article argues that the most effective defense is to ensure agents never possess secrets directly, instead using a broker pattern where the agent can be fully compromised without enabling theft.", "body_md": "**/**\n\n# Agents need the internet, and that is the problem\n\nAn agent cut off from the network cannot do much. It cannot call an API, fetch a document, or install the dependency the job requires. Give it open internet access instead and you have handed an untrusted input channel to something holding your secrets.\n\nPrompt injection is not an exotic attack. An agent's real instructions come from you. Everything it fetches and opens on the way to carrying them out is only context. But **authority does not show up reliably in text**, so a line planted anywhere in that context can be misread as an order, and the agent could carry it out.\n\n## It takes three things\n\nThree things have to be present at once before an attacker gets anything: the agent has access to something worth taking, it is exposed to content someone else controls, and it has a way to send data outward. Simon Willison named this combination the [lethal trifecta](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/), and any two of the three leave nothing to steal. All three, and a planted instruction can reach your secret and send it back out to whoever planted it. That is exfiltration, and it is the point of the attack.\n\nThe way out is the leg people try to close first, and it is the hardest one. Sending data out does not need a channel built for it. An API call, a fetched image, a link in a report, a pull request: anything that leaves the machine can carry a key along with it. **Closing every route out of a machine you deliberately gave the internet is an option, but a heavy one.**\n\nExposure is no easier to remove. An agent that reads a page, opens a document, or picks up a file another agent left behind is exposed by design, because that is the work. Which leaves what the agent is holding.\n\n## Use is not possession\n\nThe first leg looks like a dead end too. The agent needs the key, and that is the job. Call the service, sign the request, get the data back.\n\nExcept \"needs the key\" is an assumption, and it is wrong. **What the agent needs is the door to open. It does not need to be carrying what opens it.** We hand people that distinction all day: the assistant who books the flight without ever seeing the card number.\n\nSo we stopped asking the agent to keep a secret. Keeping a secret is a discipline, discipline is a property of judgment, and judgment is exactly what prompt injection attacks.\n\nMove the boundary somewhere language cannot reach. Let the agent be fully fooled, and have the worst outcome still be nothing worth having. **That does not make the agent safe. It makes it harmless to rob.**\n\nThat is the honest edge. An agent acting with authority it does not hold can still be talked into acting. Spending, deleting, sending: every power you granted turned toward someone else's purpose. That is the confused deputy, and it is old, and it is not solved.\n\nWhat is off the table is theft. Misuse is bounded by what you granted, visible while it happens, and revocable once you notice. **A stolen credential is none of those. It leaves the building.**", "url": "https://wpnews.pro/news/agents-need-the-internet-and-that-is-the-problem", "canonical_source": "https://paodo-solution.com/posts/agents-need-the-internet", "published_at": "2026-08-12 22:09:45+00:00", "updated_at": "2026-08-12 22:41:55.874855+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "artificial-intelligence"], "entities": ["Simon Willison"], "alternates": {"html": "https://wpnews.pro/news/agents-need-the-internet-and-that-is-the-problem", "markdown": "https://wpnews.pro/news/agents-need-the-internet-and-that-is-the-problem.md", "text": "https://wpnews.pro/news/agents-need-the-internet-and-that-is-the-problem.txt", "jsonld": "https://wpnews.pro/news/agents-need-the-internet-and-that-is-the-problem.jsonld"}}