Your AI Agent Trusts Everything It Reads — A Field Guide to Hijacking Claude, GPT, Gemini & Copilot
A README file in your ~/Downloads folder should not be able to expose your SSH keys. A calendar invite should not be able to trigger actions in your smart home. An email should not be able to persuade an AI assistant to leak your company's files. Yet researchers have demonstrated attacks against agents connected to local files, calendars, mailboxes, browsers, and external tools — and vendors have…
The core vulnerability that underlies most AI agent attacks is known as indirect prompt injection. This occurs when an attacker plants text, which the agent later reads as part of its normal task. The agent then executes that hidden instruction as if it were something given by the user. To break it down, an attacker needs three components: access to private data, exposure to untrusted content, and a way to send data out.
When these three factors align, a single sentence of attacker text can lead to data theft or unauthorized actions. This is known as the "lethal trifecta", a phrase coined by researcher Simon Willison. Despite the complexity, the fundamental issue is that messages, roles, and formatting in LLMs don't provide a reliable security boundary between trusted instructions and attacker-controlled content.
Therefore, the application itself must enforce authority, permissions, and action limits, rather than relying on the model alone.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
