Agent safety audit

An agent that can read your private data, reads text a stranger wrote, and can send data out can be talked into leaking that data by one crafted message. The prompt does not stop it reliably. Removing one of the three legs does. Your job: find the three legs in this setup, show exactly what opens each one, and name the cheapest one to cut.

Read references/trifecta.md once if the terms are new to you.

Steps