Give It Your Keys (Carefully)
Run It Without You
Read-aloud narrates the unit in a natural voice, paragraph by paragraph. It needs an account.
In short
Prompt injection is structural: models can't reliably separate data from instructions, so anyone who can put text in front of your AI can try to steer it, and no general fix exists.
The Hook
Every AI product you use is currently asking for keys. Connect your email. Connect your calendar. Connect your files, your notes, your shop, your bank. Say yes, and the assistant stops being a clever stranger and becomes something like staff: it knows your schedule, drafts in your voice, files things where they go.
Here's what the connect button doesn't say. The moment an AI can read your private data, and also reads things strangers wrote (emails, comments, web pages), and can also send things out into the world, you have assembled a machine with a known, unfixed flaw. Not a rare bug. A structural one, demonstrated against major products, patched case by case and never solved in general.
This is the deepest unit in the course, because the flaw has a shape, the shape has a name, and once you can see it, you can build things the attack simply cannot reach.
The mental model: never let the three keys touch.
First, the flaw. A language model processes one stream of text: your instructions, your files, and whatever else got loaded arrive together, and the model continues from all of it. An attack where instructions are hidden inside content an AI reads (a webpage, an email, a form field, a comment) so the AI follows the attacker's orders instead of its owner's. exploits exactly this: an attacker plants instructions inside content your AI will read, and the model, unable to reliably tell data from commands, follows them. This isn't hypothetical and isn't rare; it's been demonstrated against email assistants, browser agents, coding tools, and enterprise platforms, and as of 2026 there is no general fix. Filters catch some phrasings; attackers write new ones. You cannot prompt your way out, because the defense and the attack are made of the same material: text.
So the durable defense isn't a filter. It's an architecture rule, named the lethal trifecta by the researcher Simon Willison, and taught here as the three keys. An AI system becomes dangerous exactly when it holds all three at once:
Key 1, private data. It can read things that matter: your files, messages, customer records, credentials.
Key 2, untrusted input. It reads content strangers can write: web pages, incoming email, form submissions, comments, documents from outside.
Key 3, outbound action. It can send, post, share, or call the world without a human approving each act.
Any two keys are livable. Private data plus untrusted input, but no unsupervised sending? An attacker can confuse your AI but can't get anything out. Untrusted input plus outbound action, but no private data? There's nothing worth stealing. Private data plus outbound action, but only trusted input? No way in for the attacker's instructions. The catastrophe requires all three: a way in (key 2), something worth taking (key 1), and a way out (key 3). So the operator's rule is exactly that: for every AI system you configure, make sure at least one key is missing, and know which one, on purpose.
Banks figured this out centuries ago. The teller who talks to strangers all day doesn't hold the vault combination. The person with vault access doesn't process instructions that walk in off the street. And large money movements need a second signature no matter who requests them. No single employee holds public contact, vault access, and unsupervised transfer power at once, not because any employee is suspected, but because the combination is the vulnerability. Your AI is the employee. Design its job the same way.
Now watch the attack, and break it. This sandbox gives the Studio all three keys and lets a hostile comment do the rest. Run the hijack once so you've seen it, then find which single key removal stops it:
Three keys hang above the Studio. Leave them all on and run it against a public comment feed. Then take one away and run it again. Everything on screen is simulated.
Everything you just saw is simulated. Everything it models has happened to real systems.
In 2025, researchers at Noma Security disclosed a vulnerability chain in Salesforce Agentforce, the AI-agent layer of one of the world's biggest business platforms, and it is this unit's diagram wearing enterprise clothing. The way in: Agentforce processed web-to-lead forms, meaning any stranger on the internet could type text the AI would later read, and the researchers put instructions in the description field (key 2). The prize: the agent had access to CRM records, customer data a business runs on (key 1). The way out: the agent could fetch URLs, and the attackers found a domain on Salesforce's own trusted allowlist that had expired, bought it for about five dollars, and had the agent embed stolen data in requests to it (key 3). Rated 9.4 out of 10 in severity. When an employee later asked the agent a routine question about leads, the whole chain fired: data walked out through a trusted door, and no one clicked anything malicious.
Salesforce patched it: enforced trusted URLs, re-secured the domain. Which is exactly the point. The patch closed one way out. It could not remove the structural fact that an agent holding all three keys is one clever way-out discovery from the same story. Patches are whack-a-mole; key removal is architecture. Noma's own conclusion was the operator's: inventory your agents, and treat everything a stranger can type as an attack surface.
The instinct is to test your assistant: paste in a crude injection, watch it refuse, feel safe. Three problems. First, refusing the injection you tried says nothing about the thousand phrasings you didn't; models that pass obvious tests fall to oblique ones, and attackers iterate faster than you test. Second, injections don't look like attacks: they hide in white-on-white text, in a calendar invite's notes field, in page 40 of a PDF, in a comment's second paragraph. Third, and most important: the model isn't failing when it obeys injected text. It's doing exactly what it does, continuing from its input. That's why every serious treatment of this problem, from the researchers who named it to the vendors patching it, lands in the same place: assume injection succeeds sometimes, and design so that when it does, the blast radius is a shrug. Missing key, small blast.
Free path: the sandbox is built in, and the audit steps use settings screens on whatever free assistants you already use. Nothing here requires a paid plan.
Step 1, run the hijack. In the injection sandbox above: all three keys on, run, and watch the attack path light up end to end. Then break it three ways, one key at a time, and read where the chain snaps each time. You now understand this attack better than most professionals did in 2024.
Step 2, inventory your real keys. Open the settings of your main assistant (Claude, ChatGPT, or Gemini) and find the connectors, extensions, or apps screen. List every connection you've granted. For each, mark which keys it holds: does it reach private data? does it read stranger-writable content? can it act outward without you?
Step 3, find your trifectas. Any single connection, or combination active in the same assistant, that assembles all three keys goes on a shortlist. Common finds: an email connector with send rights, a browser or web-reading agent alongside file access, an "act on my behalf" mode you enabled during a launch-week trial and forgot.
Step 4, break one on purpose. For each shortlist item, remove exactly one key, choosing the one that costs the least workflow: downgrade write to read, turn auto-send into draft-for-approval, or disconnect the stranger-facing input. Do one right now, in real settings, and write one line on what the system lost (usually: a click).
Step 5, the Studio's policy, then yours. The Studio's comment-reading agent holds key 2 by definition, so its policy removes key 3: it can read everything and draft anything, and nothing leaves without the human gate; its data access (key 1) is scoped to the content library only, never the customer list. Now write your own connector permission policy, this unit's artifact, in the same shape:
PromptCONNECTOR PERMISSION POLICY Default: new connections get read-only, narrowest scope, no outbound. Trifecta rule: no system of mine holds private data + untrusted input + unsupervised outbound. For each system, the missing key is: [name it, per system]. Outbound rule: anything that sends, posts, or spends waits at a human gate. Scope rule: one folder, not the drive; one inbox label, not the account, wherever the platform allows. Review: full key inventory rerun quarterly (Unit 12 will schedule it).
The Handoff: the policy goes into your Unit 01 workspaces as a standing file, and it becomes law for every automation you build in the next unit.
Operator Moves
Name the missing key. For every AI system you run, be able to say in one sentence which of the three keys it lacks and why that's the cheap one to drop. If you can't name it, the system is running on luck.
Read-only until proven otherwise. Grant new connectors the narrowest scope offered: read before write, one folder before the drive, drafts before sends. Upgrades are one click away the day a workflow earns them; downgrades after an incident are not.
Treat inputs like ingredients. Before wiring any content source into an agent, ask who can write to it. Your own notes: trusted. Anything a stranger can type into (comments, inbound mail, forms, the open web): that's key 2, and its presence must cost the system one of the other keys.
Next unit, your systems start running while you sleep, and everything in the wider world is racing the same way: assistants with inbox access, browser agents that shop and book, enterprise agents wired into company data. Every one of them is a three-keys exam, and most of their builders haven't taken this unit. The public incidents so far (CRM exfiltration, hijacked email assistants, poisoned documents steering coding agents) all reduce to the same diagram you broke in the sandbox, which means you now read security news the way you read the harness in Unit 05: structurally.
There's also a personal inversion worth noticing. In Unit 03 you learned your AI can be wrong; here you learned it can be turned: made to work for whoever writes the text it reads. That's not a reason to disconnect everything. Connected AI is where the value is. It's a reason to be the person in the room who asks the only question that scales: which key is missing? Ask it about your own systems, your school's, your employer's. The answer is a one-sentence audit that regularly beats a security review.
The Key Audit
Find every key you've handed out, break your trifectas, and write the law.
- Full inventory: every connector, extension, app, and agent permission across the AI tools you actually use. One line each: name, and which of the three keys it holds.
- Mark the trifectas: flag any system (or combination inside one assistant) where all three keys touch. Zero is a fine answer if you can show your work.
- Break at least one key for real: in live settings, remove or downgrade the cheapest key on your worst finding (or, if you found no trifecta, tighten one scope anyway: read-only, narrower folder, draft-not-send). Record what workflow cost it actually had.
- Rerun the sandbox deliberately: find the single-key removal that stops the hijack while keeping the Studio most useful, and write two sentences defending that choice.
- Write your connector permission policy using the demo's template, with the missing key named per system.
- The Handoff: file the policy in your Unit 01 workspaces; Unit 08's automations must comply with it before they're allowed to run.
- 1Prompt injection is structural: models can't reliably separate data from instructions, so anyone who can put text in front of your AI can try to steer it, and no general fix exists.
- 2The lethal trifecta names the danger: private data, untrusted input, and unsupervised outbound action, together. Any two are livable; all three are the attack chain assembled.
- 3The defense is architecture, not vigilance: for every system, remove or gate one key on purpose, and be able to name which. Filters fight text with text and eventually lose; missing links win by default.
- 4Scope like a bank: read-only defaults, narrowest access, gates on everything outbound, and a quarterly key inventory. Connected AI is worth it; keys-by-design is the price.
Type: Article Title: The lethal trifecta for AI agents, Simon Willison URL: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ Description: The essay that named this unit's rule, by the researcher who has tracked prompt injection since it was born. Short, sharp, and full of real attack write-ups. Read it, then follow one link into his injection archive and see how many incidents reduce to the diagram you broke today.
| Type | Title | URL | Description |
|---|---|---|---|
| Article | Simon Willison, "The lethal trifecta for AI agents" (June 2025) | simonwillison.net/2025/Jun/16/the-let… | The three-keys rule, from the researcher who named prompt injection |
| Research | Noma Security, "ForcedLeak" disclosure | noma.security/blog/forcedleak-age… | The primary write-up of this unit's case study, CVSS 9.4 |
| Article | The Hacker News, Salesforce patches ForcedLeak (Sept 2025) | thehackernews.com/2025/09/salesforce-… | Independent coverage: the five-dollar domain and the patch |
| Article | The Register, ForcedLeak and agent security holes (Sept 2025) | theregister.com/2025/09/26/salesfor… | The attack chain explained for practitioners |
| Docs | OWASP, LLM prompt injection (LLM01) | genai.owasp.org/llmrisk/llm01-promp… | The industry-standard classification of injection risks and mitigations |
| Docs | Anthropic, Claude connectors and permissions help | support.claude.com/en/collections/4856… | Where the keys live in one assistant's real settings |
Last updated: August 9, 2026. Connector names and settings screens change; the three-keys rule is the durable defense.
Marking a unit complete, the Prove It check and your place in the course all need an account. The reading stays free.