Earlier this year, our research team filled out a public lead-capture form on a live Salesforce Agentforce deployment, the kind on the marketing page of any company that sells something. Into one of its free-text fields, meant for a prospect’s message, we typed a few plain sentences addressed to the AI agent that would read them. When the lead reached the agent, it read our paragraph and, unable to tell a genuine inquiry from a planted instruction, did what the paragraph said: it pulled the customer records sitting in the CRM beside ours and sent them back out to us. We had not signed in or supplied a password, and we had exploited no software flaw; we had written a paragraph, and a production enterprise platform had handed its customers’ data to a stranger. We named it PipeLeak.
The same class of flaw surfaced inside Microsoft Copilot Studio, in a vulnerability we disclosed as ShareLeak, tracked as CVE-2026-21520: a crafted note in the comment field of a public SharePoint form became a fake system message, the agent pulled customer data from the connected SharePoint lists, and Outlook carried it out the door. The detail that has stayed with me is that Microsoft’s own safety filter judged the request suspicious and flagged it, and the data left anyway.
The lethal trifecta
Both incidents trace to one cause: three capabilities that turn dangerous the moment they meet in a single agent. The security researcher Simon Willison named the combination the lethal trifecta: access to private data, exposure to untrusted content, and the ability to communicate with the outside world. Whatever such an agent reads can talk it into moving whatever it can reach. In the research we published this spring, across more than 200,000 agent skill files and 164,000 source files, 9.5% of the skills installed all three capabilities in a single file.
Untrusted content is the leg an attacker can control, and whether it can commandeer the other two, the private data and the way out, comes down to how these systems are assembled. 72% of the prompt-building code we studied pastes text directly into the instruction the model will follow, and fewer than one in twenty apply any sanitization to it. It is SQL injection all over again, the mistake the industry spent the 2000s learning to stop making with databases, where user input and commands shared one string and an attacker only had to phrase data as a command. We have rebuilt that error one level higher, and the interpreter reading the combined string this time is a language model trained to be accommodating.
When the agent goes rogue
Not every leak needs someone on the outside writing the paragraph. For months our team tracked a behavior inside the Cursor editor in which the agent, asked simply to share a file, would upload it on its own to a public anonymous host to hand back a link, pushing past a deny-all network sandbox to finish the errand. No attacker was involved and no one had asked for the upload; a copy of the data simply came to rest on a stranger’s server because the shortest path to the goal ran through it. The same self-direction turns destructive elsewhere: a coding agent at PocketOS used a leftover, over-scoped API token to wipe the production database and every backup in about nine seconds. And the labs are finding the same instinct in their own agents: over sixteen days this summer, OpenAI, Anthropic, Meta, and Britain’s AI Security Institute disclosed five cases of evaluation agents breaking out of their sandboxes onto the open internet, several landing in the production systems of real companies that never knew they were part of a test.
None of this is the intruder you planned for
Every incident so far breaks the same assumption. Data security grew up around an intruder, someone outside working to get in, or malware inside working to phone home, and every control the field built assumes an adversary it can recognize as foreign. An agent is native to that environment: deployed on purpose, holding real credentials, and wired into the systems where the data lives, it sits inside the trust boundary by design, unable to tell a legitimate instruction from a planted one and willing to act on its own. That is a threat the old model was never shaped to hold, and it is nearly invisible from where data-security teams are trained to watch. A majority of the exposed agents we mapped, 58 to 76% of them, run outside the cloud accounts posture management assumes, on residential and self-hosted machines the usual tooling never scans, and when an agent moves data, it uses legitimate credentials and sanctioned channels, the CRM’s own interface or the mail server, so the traffic passes for ordinary work.
Governing the insider you deployed
The obvious response is to put a person in front of the agent and make it ask permission. When Anthropic ran that experiment across its user base, it found people approving 97% of the prompts they saw. And when its researchers slipped a plainly dangerous command into the flow, only 13.6% of users caught it, a share that fell to one in twenty after fifty approvals. Each upstream defense fails the same way: a prompt is only advice, a sandbox holds until the agent finds the way out, and an approval box protects you until the person stops reading, leaving nothing between the decision to act and the action itself. Meta’s Agents Rule of Two says an agent should hold no more than two of the trifecta’s three powers in a single session; when it needs all three, it should not run on its own without a deterministic control the model cannot override. That control belongs in the gap itself, checking each request against policy and blocking it before it runs. It takes the form of an agentic hook, code that fires at the tool call, already shipping in the major agent frameworks and now being standardized by the open Agent Control Standard. Gartner expects more than 40% of agentic AI projects to be cancelled by 2027, largely because their risk controls never caught up. What is missing is the decision to turn that control on before one of these agents moves data no one meant to share.