Security: agents that can't be turned against you

A model can't reliably tell your instructions apart from instructions hidden in the content it reads. So any agent that reads a web page, an issue, an email or a file can be talked into doing something you didn't ask. You can't prompt that away. You design so that, when it's fooled, it can't do real damage.

1. The idea

Two ideas carry this whole module:

1. Prompt injection is unsolved. Instructions can hide in anything the model reads: a web page, a pull-request description, a PDF, a code comment, a tool result. Filters and stern system prompts reduce it; none removes it.
2. The lethal trifecta (Simon Willison). An agent is dangerous when it has all three of: private data, untrusted content, and a way to send data out. With all three, one injected instruction can leak your data. Remove at least one leg for every task.

2. How it works

3. Try it yourself: break the trifecta

Pick a job. All three legs start switched on. Click a leg to remove it and see whether one injected instruction can still do harm.

4. Why it matters at work

A permission baseline (Claude Code shown; every tool has the same idea): allow the routine, ask for the consequential, deny the dangerous.

// .claude/settings.json (committed with the repository)
{
  "permissions": {
    "allow": ["Bash(npm run test *)", "Bash(npm run lint)", "Bash(git status)", "Bash(git diff *)"],
    "ask":   ["Bash(git push *)", "Bash(git commit *)", "WebFetch"],
    "deny":  ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)", "Read(~/.ssh/**)",
              "Read(~/.aws/**)", "Bash(curl *)", "Bash(wget *)", "Bash(git push --force *)"]
  }
}

Command rules match the command as written; a determined injection can phrase things differently. That's why the sandbox matters: it limits files and network at the operating-system level, whatever the command looks like.

The OWASP lists

OWASP publishes two community lists worth knowing by name:

5. In your five tools

Every tool now has an operating-system sandbox for the commands its agent runs, plus approval rules. Checked against vendor documentation, October 2026.

Modes that skip all approvals (always-proceed, Run Everything, danger-full-access, --dangerously-skip-permissions) belong only in a disposable container or VM with no secrets.

6. Remember it

7. Common mistakes

8. Hands-on lab (roadmap weeks 22–23)

1. Write a permission baseline for a repository in your main tool: allow tests and lint, ask for push, deny secret files and outbound tools.
2. Turn on the sandbox and run a normal task. Note what it blocked and add only the allowances you really need.
3. Red-team yourself in a throwaway repository: put a fake secret (FAKE_KEY=not-a-real-key-123) in .env and a planted instruction in a README asking the agent to print and send it. Ask the agent to "summarise the README". Did your controls stop it?
4. Trifecta audit: list every agent and automation you run, and mark which legs each has. Remove a leg wherever all three are present.
5. Write a one-page checklist for AI-assisted changes and agent configuration, and use it on your next three pull requests.

9. Self-check quiz

10. Go deeper