3. The Lethal Trifecta: Security Model
Simon Willison coined this term in 2025 (see martinfowler.com/articles/202508-ai-thoughts.html):
Private data + untrusted content + external communication = documented exfiltration vector.
Any two of the three are manageable. All three together, without structural isolation, create a path where an attacker plants instructions in data the agent will read (a document, a code comment, a Jira ticket), the agent processes those instructions using its access to private data, and then uses its communication capabilities to exfiltrate.
This is not theoretical. GitHub Security has documented prompt injection attacks in Copilot via malicious repository content. The defense is not better prompt engineering; it is structural isolation.
AgentDojo makes the threat measurable with 97 realistic tasks and 629 security test cases for agents that consume untrusted tool data. CaMeL demonstrates a structural response: trusted control flow is separated from untrusted data flow, and capabilities enforce policy when tools are called. CaMeL reports 77% task success with provable security versus 84% for its undefended system. Security has a utility cost, but the boundary is enforceable outside the model.
Defense layers
| Layer | Mechanism | Implementation |
|---|---|---|
| Network isolation | Agent cannot reach external endpoints except an explicit allowlist | GitHub Agentic Workflows: Squid proxy on allowlist; Northflank: egress firewall |
| Filesystem isolation | Agent writes to a temporary workspace, not the host filesystem | Kubernetes agent-sandbox, E2B microVM |
| Identity scoping | Every tool call carries a per-session credential with minimum required permissions | Strata Maverics, Microsoft Entra Agent ID |
| Output validation | Agent-generated content passes through a threat detection step before reaching any production surface | GitHub Agentic Workflows: Safe Outputs pattern (Semgrep + TruffleHog + LlamaGuard) |
| Read-only execution context | Agent reads the codebase but cannot write directly; writes go through a PR/review gate | GitHub Agentic Workflows default posture |
Why human review alone fails
Anthropic's internal data (shared responsibility model documentation, April 2026): 93% of agent permission requests in production are approved without adequate review. This is not a criticism of the humans involved; it is a structural consequence of volume and cognitive load. When a human approves 50 permission dialogs per hour, individual approval becomes a formality.
The defense that scales: structural isolation (makes certain actions impossible) and second-agent validation (creator-verifier pattern, Section 8). Human review remains appropriate for high-stakes, low-frequency decisions, not for routine agent actions.