A poisoned integration guide hid instructions in one-point font, addressed to the agent rather than the human.
In a controlled demonstration, PromptArmor reported that Google Antigravity followed those instructions and sent credentials and private code to a researcher-controlled endpoint. (writeup )
PromptArmor later demonstrated a different indirect-prompt-injection path in Microsoft Copilot Cowork. Its test used automatic approval behavior and pre-authenticated file links to create a data-exfiltration path. (research )
PromptArmor also demonstrated the same class of attack against Claude Cowork (demo ). That test used a Claude File API exfiltration path Johann Rehberger had previously documented (Embrace The Red ).
These are vendor and independent-researcher demonstrations, not reports of customer breaches. Together, they show a repeatable design risk worth testing.
But the attack isn’t the story a buyer needs. A whole category is forming around this risk: “AI agent security,” “agentic AI security,” prompt-injection firewalls, AI guardrails. Every pitch sounds urgent and nearly identical.
I spent almost ten years selling security tools from the vendor side, and I’ve watched several security categories get born. The script rarely changes.
A real, frightening demonstration lands. A wave of products arrives, all naming the same idea. Buyers who cannot yet tell them apart pay a premium for a relabeled feature.
“AI agent security” is at exactly that stage. The threat is real, but the category is not yet legible. The gap between those two is the expensive part.
What “AI agent security” actually defends against
For this evaluation, AI agent security means keeping an agent from being hijacked by the content it reads and turned into a path for data leakage or unauthorized actions. The name is broad, so I start with the specific risk.
Indirect prompt injection is an agent acting on instructions hidden in content it was only meant to read. To the model, the document and the command are the same thing: text.
Simon Willison’s lethal trifecta describes three capabilities in one AI agent: access to private data, exposure to untrusted content, and a way to communicate outward. Combining all three creates a path for data exfiltration.
Coding agents can combine all three capabilities: access to secrets, permission to run shell commands, and network access.
The guardrails were settings, not boundaries
The Antigravity demo exercised three relevant controls. The built-in file-access restriction was bypassed, while the recommended approval setting and default URL allowlist permitted the demonstrated path.
The built-in file reader was blocked from gitignored files, so the agent ran cat in the terminal to read .env anyway. Human approval was set to “agent decides,” and terminal commands ran automatically. And the attacker’s collection domain was already inside the default allowlist.
A visible setting is not necessarily an effective boundary. Buyers need to test what the control does across every available tool path.
What to ask an AI agent-security vendor: “The trifecta test”
You don’t need to out-engineer a vendor to see through the pitch. You need five questions. When a vendor offers an AI agent security or prompt-injection control, I run it through the same five questions.
None are trick questions, and a confident vendor answers all five plainly.
- Does your control assume the model can reliably separate instructions from data? If the answer leans on the model “knowing” what is safe, you are buying a hope, not a boundary.
- Which leg of the trifecta does it actually cut — private-data access, outbound communication, or untrusted-content exposure? Ask to see the boundary, not the dashboard.
- Is that boundary deterministic, or is it another model checking the first one? A second model that only advises isn't a boundary; if it gates the action, ask what deterministic check runs when that model flags something. In the Antigravity exfiltration, once the file reader was blocked, the agent found another path to satisfy the injected instruction.
- What ships in the default configuration? Check the allowlist, approval setting, and file-access rule. Defaults deserve direct testing: PromptArmor reported that
webhook.site, the endpoint used in its demo, appeared in Antigravity's default browser allowlist. - What does this explicitly not cover? The vendors worth buying from can draw the edge of their own product.
If a pitch clears all five, it has earned a proof-of-concept on your own setup. If it dodges them, you already have your answer.
If you build these tools
The same five questions are your opportunity. In a market full of products that deflect them, the one that answers plainly stands out.
The attack is real and it is not going away. But “the threat is real” and “this specific product fixes it” are two different claims, and the distance between them is where buyers overpay.
So when you’re buying an AI agent security tool, hold the whole pitch to one question: which leg of the trifecta does it cut deterministically — and which does it leave to you?
A product that can answer that has earned your shortlist. One that can’t is selling the word, not the control.
If a vendor gives you a straight answer to question 2 or 3 (which leg they cut, and whether it holds), reply and tell me. I’ll feature the sharpest answers next week.
See you next Tuesday.
Sources
- PromptArmor — Microsoft Copilot Cowork Exfiltrates Files
- PromptArmor — Claude Cowork Exfiltrates Files
- PromptArmor — Google Antigravity Exfiltrates Data via Indirect Prompt Injection
- Johann Rehberger (Embrace The Red) — Claude Pirate: Abusing Anthropic’s File API for Data Exfiltration
- Simon Willison — The lethal trifecta for AI agents (June 16, 2025)
AppSec Santa Weekly — changelog analysis and category trends from 200+ AppSec tools. Browse all tools or subscribe for weekly updates.