The Lethal Trifecta: Why Prompt Injection Is Still Winning

Every security team has a playbook for malware, phishing and stolen credentials. Very few have one for an attacker who never touches the network, and simply leaves a sentence on a web page for your AI agent to read.

That is prompt injection. At Infosecurity Europe in June 2026, researchers were clear: it remains unsolved at a fundamental level. OWASP maps it to six of the ten categories in its Top 10 for Agentic Applications.

Why It Cannot Be Patched

A language model reads its instructions, the user's request and any retrieved document as one continuous stream of text. There is no reliable privilege boundary between "the system says" and "a web page says". When the model only produced text, an injection gave you a wrong answer. Now that agents send emails, move files and call APIs, an injection gives the attacker an action.

The Lethal Trifecta

Security researcher Simon Willison named the danger zone. An agent becomes an exfiltration tool when it combines three things:

1. Access to private data. Your inbox, your CRM, your file shares.

2. Exposure to untrusted content. Web pages, inbound emails, uploaded documents.

3. The ability to communicate externally. Sending messages, making web requests, writing to shared locations.

Meta's answer is the Rule of Two: no agent should hold more than two of the three without a human approving the action.

The Minimal-Stack Response

This is The Shield Paradox all over again. Bolting another filter onto an over-privileged agent adds complexity, not safety. The stronger move is fewer permissions, short-lived credentials, behavioural monitoring that runs at agent speed, and a kill switch that works without a meeting.

Conclusion

Treat every agent like a new hire with a gullible streak: useful, fast, and never given the keys to everything at once. Scope it, watch it, and make sure a human signs off on anything that leaves the building.