Lesson deck
Limiting blast radius and treating output as untrusted flashcards
Reviewing needs JavaScript. You can read every card in the list below.
Loading your cards...
Back to the lesson4 cards in this deck
Read all 4 cards as a list
- Front
- What is least privilege (privilege separation) for agents?
- Back
- Give each agent and tool only the tools, data and permissions the task needs, and keep read capabilities apart from write or send capabilities, so a successful attack has a small blast radius.
- Front
- When should an agent require human approval before acting?
- Back
- Before irreversible, high-value or external-facing actions such as payments, deletions, sending messages and publishing.
- Front
- What is the lethal trifecta?
- Back
- An agent that combines access to private data, exposure to untrusted content and the ability to communicate externally is at risk of data theft. Avoid having all three in one agent (Simon Willison, 2025).
- Front
- What is improper output handling?
- Back
- Passing model output to a browser, database, shell or other system without validating or encoding it. Prompts can steer output, so treat it as untrusted input (XSS, SQL injection, code execution).