Agents need the internet, and that is the problem — PAODO

Prompt injection is not an exotic attack. An agent's real instructions come from you. Everything it fetches and opens on the way to carrying them out is only context. But authority does not show up reliably in text , so a line planted anywhere in that context can be misread as an order, and the agent could carry it out.

It takes three things

Three things have to be present at once before an attacker gets anything: the agent has access to something worth taking, it is exposed to content someone else controls, and it has a way to send data outward. Simon Willison named this combination the lethal trifecta, and any two of the three leave nothing to steal. All three, and a planted instruction can reach your secret and send it back out to whoever planted it. That is exfiltration, and it is the point of the attack.

The way out is the leg people try to close first, and it is the hardest one. Sending data out does not need a channel built for it. An API call, a fetched image, a link in a report, a pull request: anything that leaves the machine can carry a key along with it. Closing every route out of a machine you deliberately gave the internet is an option, but a heavy one.

Exposure is no easier to remove. An agent that reads a page, opens a document, or picks up a file another agent left behind is exposed by design, because that is the work. Which leaves what the agent is holding.

Use is not possession

The first leg looks like a dead end too. The agent needs the key, and that is the job. Call the service, sign the request, get the data back.

Except "needs the key" is an assumption, and it is wrong. What the agent needs is the door to open. It does not need to be carrying what opens it. We hand people that distinction all day: the assistant who books the flight without ever seeing the card number.

So we stopped asking the agent to keep a secret. Keeping a secret is a discipline, discipline is a property of judgment, and judgment is exactly what prompt injection attacks.

Move the boundary somewhere language cannot reach. Let the agent be fully fooled, and have the worst outcome still be nothing worth having. That does not make the agent safe. It makes it harmless to rob.

That is the honest edge. An agent acting with authority it does not hold can still be talked into acting. Spending, deleting, sending: every power you granted turned toward someone else's purpose. That is the confused deputy, and it is old, and it is not solved.

What is off the table is theft. Misuse is bounded by what you granted, visible while it happens, and revocable once you notice. A stolen credential is none of those. It leaves the building.