egress control

When an agent holds private data, reads untrusted text, and can talk to the outside, injected instructions can steal data. This 'lethal trifecta' is the defining agent vulnerability. The fix is architectural, not a better prompt.

A hijacked agent does not need a 'send email' tool to leak secrets. A rendered markdown image, a URL parameter, or a DNS lookup will do. The signal is enumerating the covert channels and locking down egress, not just tools.