Article

The lethal trifecta for AI agents

Simon Willison · simonwillison.net

The single most important security idea for anyone deploying agents.

Open on simonwillison.net ↗

It answers 3 questions

  1. Is it safe to let an AI agent use my logged-in email, bank or social media accounts?
  2. What can go wrong when an agent acts on my behalf, and how do I keep it safe?
  3. Is it safe to let an AI agent or AI browser log in to my email, bank or shopping accounts?

Read with it

  1. Anthropic on letting Claude act in the browser without approving each step, with a safety classifier checking every action. claude.com Article Claude in Chrome is generally available Anthropic
  2. Survey finding that 24% of US AI users use an agent regularly and 32% have let AI act for them without final approval, which is... menlovc.com Article 2026: The State of Consumer AI Menlo Ventures
  3. How an always-on agent is fenced in: its own sandboxed computer, read-only background research, auto-review of actions and... openai.com Article How we build safety, security, and privacy into dots OpenAI
  4. A worked demonstration of a hidden Reddit comment steering an AI browser into a signed-in email account. brave.com Article Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet Brave (Artem Chaikin and Shivan Kaul Sahib)
  5. Anthropic's research note on how it trains and screens a browsing agent against hidden instructions. anthropic.com Article Mitigating the risk of prompt injections in browser use Anthropic
  6. The same argument in shareable form for your team channel. simonw.substack.com Article The lethal trifecta (newsletter edition) Simon Willison
eChai Partner Brands The partnership →