The "lethal trifecta": To be useful, an agent needs internet access, untrusted inputs, and your private information.
So it can get prompt injected and exfiltrate your data. (Indeed I read that Claude Code puts your email address into HTTP requests it makes to random servers?)
My solution here was to just not give it anything, but that does preclude the "my claw bought a car!" result everyone's excited about.
My way of thinking here is "blast radius". Assume it will get prompt injected. What goes wrong? Then design the setup so that scenario is not bad. e.g. it has my keys but they've got $5 of credit on them. It has access to the filesystem, but only on its own Linux account. (Ok I set this up last year before they could communicate thru the bloody CPU cache, might need an update :)
https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
The "lethal trifecta": To be useful, an agent needs internet access, untrusted inputs, and your private information.
So it can get prompt injected and exfiltrate your data. (Indeed I read that Claude Code puts your email address into HTTP requests it makes to random servers?)
My solution here was to just not give it anything, but that does preclude the "my claw bought a car!" result everyone's excited about.
My way of thinking here is "blast radius". Assume it will get prompt injected. What goes wrong? Then design the setup so that scenario is not bad. e.g. it has my keys but they've got $5 of credit on them. It has access to the filesystem, but only on its own Linux account. (Ok I set this up last year before they could communicate thru the bloody CPU cache, might need an update :)