Notes

Your agent trusts the tool description. That's the hole.

To a language model there's no difference between the data you gave it and an instruction — it reads everything as a possible command. That one fact is the whole of AI agent security. Here's how it turns a helpful tool into a data-exfiltration vector, why a prompt can't fix it, and the one structural rule — the lethal trifecta — that tells you when your agent is genuinely dangerous.

• agents
• security
• methodology