Agent WranglersAPS-84Required
Break the lethal trifecta
Never give one agent all three of private data, untrusted content and a way to send data out. Remove at least one.
How to do it
List each agent's data, inputs and outputs. If it reads private data and outside content, block links, images, email and web requests that leave your site. Or split the work into two agents, so the one that reads outside content never sees private data.
How to check
A test reads each agent's declared tools and marks which read private data, which read outside content and which can send data out. It fails on any agent that has all three. In staging, give the agent a page asking it to put a test record into a link to test.example.org. The test server receives no request.
Sources
Related rules
- AID-73 Allow agent network traffic only to listed hosts in AI-assisted development
- AID-28 Treat what the agent reads as untrusted in AI-assisted development
- AIF-73 Connect product agents only to tools and servers on a reviewed list in AI features
- APS-83 Resist indirect prompt injection in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.