Ask what your agents can reach because any text they read can give them orders. · VANDAM

This page as Markdown llms.txt llms-full.txt services.json sitemap.xml
# Ask what your agents can reach because any text they read can give them orders. · VANDAM

> Any text an agent reads can steer it. A one-page reach review for every agent, and a sandbox for the agents your employees already brought.

URL: https://vandam.ai/notes/what-your-agents-can-reach  
Contact: hendrik@vibelab.be

# Ask what your agents can reach because any text they read can give them orders.

Prompt injection tops OWASP’s list of LLM risks, and every frontier model in a NIST-run red-teaming contest was hijacked at least once, so the limit has to sit in what an agent can touch. I lay out the one-page reach review we use and how to give employees who bring their own agents a sandbox instead of a ban.

Hendrik De Winne 26 October 2026 9 min read

In July 2025, researchers at [General Analysis](https://www.generalanalysis.com/blog/supabase-mcp-blog) set up a small test. A developer’s coding assistant in Cursor was connected to the company database with a service key that bypasses all row-level security. An attacker opened a support ticket and wrote instructions into it, addressed to the assistant. Later the developer asked the assistant to review open tickets. It read the message, treated the instructions as commands, pulled the table holding OAuth tokens and session credentials, and posted its contents back into the attacker’s ticket. The researchers’ summary: “No permissions were violated. The agent just followed instructions it should never have trusted.”

Nobody hacked anything in that story. The assistant had broad access, it read a customer’s text, and it could write somewhere the customer could see. Everything worked as configured. The orders simply came from outside the company, because to a language model an instruction in a ticket looks much like an instruction from its user.

That changes where the security decision sits. Telling an agent to behave well protects very little, since anyone who can put text in front of it can tell it something else. What protects you is what the agent can reach: which systems, which data, which ways out. That is a question a COO can ask at approval time, and it is the subject of this note. The ledger-specific controls are in [an earlier note](https://vandam.ai/notes/agents-and-internal-controls); this one covers every agent, including the ones employees brought themselves.

- **13/13**
  Frontier models hijacked at least once in a public red-teaming competition run with [NIST’s CAISI](https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agent-security-large-scale-red-teaming-competition), March 2026.
- **78%**
  Share of AI users who bring their own AI tools to work, per the 2024 [Work Trend Index](https://www.microsoft.com/en-us/worklab/work-trend-index/ai-at-work-is-here-now-comes-the-hard-part).
- **58%**
  Share of workplace Claude use that runs through personal accounts, per [Cyberhaven](https://www.cyberhaven.com/blog/sensitive-data-flowing-into-ai-tools), February 2026.
- **$50**
  Upper bound on the cost of the run that found a 27-year-old OpenBSD bug, per [Anthropic](https://www.anthropic.com/research/mythos-preview).

## Any text an agent reads can give it orders

The security community has a name for this and ranks it first. In the 2025 [OWASP Top 10 for LLM Applications](https://genai.owasp.org/llmrisk/llm01-prompt-injection/), prompt injection is LLM01. OWASP separates the direct kind, where a user types the attack, from the indirect kind, which “occur when an LLM accepts input from external sources, such as websites or files.” Company agents read email, tickets, PDFs and web pages from strangers all day, so the indirect kind is the one that matters.

The documented cases follow one pattern. In May 2025, [Invariant Labs](https://invariantlabs.ai/blog/mcp-github-vulnerability) showed that a malicious issue filed on a public GitHub repository could hijack a developer’s agent connected through GitHub’s official MCP server. The agent read the issue, went into the user’s private repositories, and published what it found, including salary information, in a pull request on the public one. In June 2025 Microsoft fixed [CVE-2025-32711](https://nvd.nist.gov/vuln/detail/CVE-2025-32711) in Microsoft 365 Copilot, rated **9.3** out of 10, which its advisory describes as “AI command injection.” The researchers who found it, at Aim Security, showed that a single email could lead Copilot to send internal data out without the recipient clicking anything.

Simon Willison, the developer who coined the term prompt injection in 2022, gave the clearest test for when this becomes dangerous. In [The lethal trifecta for AI agents](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/), published in June 2025, he names three properties: “access to your private data,” “exposure to untrusted content” and “the ability to externally communicate.” An agent with all three can be talked into reading something private and sending it to whoever asked. The Supabase and GitHub cases above each had all three.

The only way to stay safe there is to avoid that lethal trifecta combination entirely. (Simon Willison, [June 2025](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/))

## Better models reduce the odds and leave the exposure in place

The natural hope is that the next model will refuse these instructions. The evidence says it will refuse more of them, and that this is not enough to build on. In January 2025, NIST’s Center for AI Standards and Innovation [tested agent hijacking](https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations) against what was then a leading model. New attacks from its red team raised the success rate from **11%** for the strongest known attack to **81%**, and simply retrying each attack 25 times raised the average from 57% to 80%. In March 2026 CAISI reported on a [public competition](https://www.nist.gov/blogs/caisi-research-blog/insights-ai-agent-security-large-scale-red-teaming-competition) with more than 400 participants and over 250,000 attack attempts against 13 frontier models: “At least one successful attack was found against all of the target frontier models.”

An attacker needs to win once and can retry almost for free. So I plan as if the injection will eventually land, and size the damage by what the agent could touch when it does. That turns an unsolved research problem into an ordinary permissions decision.

## Stolen credentials reach exactly as far

One of the most cited incidents around an AI chat product did not involve prompt injection at all, although it is often retold as if it did. In August 2025, according to [Google Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift), an actor it tracks as UNC6395 used “compromised OAuth tokens associated with the Salesloft Drift third-party application” to export large volumes of data from numerous corporate Salesforce instances. It then searched the stolen records for AWS keys, passwords and Snowflake tokens.

The lesson for this note is the same one, from the other side. A chat integration on marketing websites held standing tokens into its customers’ CRMs. Whether an attacker steers an agent with text or steals the keys it carries, the blast radius is set by what those keys open. Every agent and every AI integration you approve adds one more set of keys to that count.

## Your people already brought their own agents

Many of the AI tools touching company data were never approved by anyone. Microsoft’s 2024 [Work Trend Index](https://www.microsoft.com/en-us/worklab/work-trend-index/ai-at-work-is-here-now-comes-the-hard-part), a survey of 31,000 workers, found that **78%** of AI users bring their own tools to work, and **80%** at small and medium companies. Cyberhaven’s [2026 report](https://www.cyberhaven.com/blog/sensitive-data-flowing-into-ai-tools), built from its customers’ data-flow telemetry, counts 32.3% of workplace ChatGPT use and 58.2% of Claude use running through personal accounts, and says **39.7%** of AI interactions involve sensitive data. Cyberhaven sells data-loss prevention, so treat these as a vendor’s view of its own customers.

The bigger shift this year is that personal tools now act. OpenClaw, the open-source agent that runs around the clock and controls email, calendar and GitHub through a chat app, has passed 390,000 stars on [GitHub](https://github.com/openclaw/openclaw) since November 2025. Its project is candid about what it is built for. Its [security policy](https://github.com/openclaw/openclaw/blob/main/SECURITY.md) calls it a “personal assistant” for one trusted operator and warns that “anyone who can operate an agent can make it do anything that agent can do.” Its creator put it more bluntly.

> The security model of OpenClaw is that it’s your PERSONAL assistant (one user - 1...many agents). IT IS NOT A BUS.
>
> Peter Steinberger, Creator of OpenClaw, February 2026, [Source](https://x.com/steipete/status/2026092642623201379)

That is a reasonable design for a personal tool. Inside a company it means an employee’s agent, logged in with that employee’s credentials, can do everything the employee can, on instructions from any email that lands in their inbox. The same applies to the quick internal apps staff now build in a weekend. [Supabase’s own documentation](https://supabase.com/docs/guides/database/postgres/row-level-security), for one of the databases these apps most often sit on, warns that “a table in an exposed schema without RLS is readable and writable by any role with a grant on it.”

A ban moves all of this to personal accounts, where you see none of it, and tells your most productive people their way of working is a disciplinary matter. The better move is to give them a place to run agents where the reach is decided by the company.

## A reach review takes one page per agent

This is the review we use before any agent, bought, built or brought, gets access to company systems. The COO or CISO signs it.

**1. Name the reach.** List every system the agent can read, every system it can write to, and every way it can send something out: email, chat, web requests, file shares, pull requests, links it renders.

**2. Check for the trifecta.** Mark whether the agent reads untrusted content, holds private data and can communicate externally. If all three are true, remove one before go-live. Usually the cheapest to remove is the outbound channel: no open web requests, sending only to an allowlist, drafts that a person releases.

**3. Give it its own identity.** The agent runs on its own account with scoped tokens, never an employee’s login, an admin key or a database service role. Tokens expire, and the agent appears in the access review like any user.

**4. Grant per task.** Read-only by default. One project, mailbox, repository or folder per job, following OWASP’s advice to “restrict the model’s access privileges to the minimum necessary for its intended operations.” Write access is added for a named task and removed after it.

**5. Put a person on the irreversible steps.** Payments, deletions, permission changes, external sends and anything touching customer records wait for a human click. Turn off “always allow” for those tools.

**6. Log what it saw and did.** Keep the inputs the agent read, the tools it called and what it sent, for long enough to reconstruct an incident.

**7. Attack it before launch, and again after changes.** Plant instructions in the documents, tickets and emails it will read and see what it does. Repeat after every model, prompt or connector change, and on a schedule measured in weeks.

**8. Keep an off switch.** One named person can revoke the agent’s tokens in minutes, and knows which ones to revoke.

The cadence in point 7 matters because finding flaws has become cheap for everyone. Anthropic reported in April that its Mythos Preview model found a 27-year-old bug in OpenBSD in a run that cost under $50, and added that the thousand runs behind it cost under $20,000 in total. In October, after AI-assisted researchers found critical flaws in PHP, the FBI advised operators who could not patch at once to take their sites offline, as the [Associated Press](https://www.adn.com/nation-world/2026/10/21/websites-scramble-to-fix-software-flaw-that-could-put-much-of-internet-at-risk/) reported. An annual penetration test and a yearly access review were designed for a slower world.

## Offer a sandbox where you would have written a ban

For the agents employees bring, my rule is to say yes on the company’s terms. In practice that is five things.

**A register.** A short form: which agent, which tools it connects to, who runs it. Registering earns access, so people have a reason to do it.

**A separate workspace.** Agents run on a company-managed machine or cloud workspace, apart from the employee’s laptop, with their own accounts: a mailbox alias, a calendar with read access, a copy of the data they need instead of the live system, a test database instead of production.

**Default scopes.** Read-only connectors to the main systems, with write access to the sandbox only. Moving an agent onto a live system goes through the reach review above.

**A named voucher.** The employee answers for what their agent produces, the same way they answer for their own work.

**An easy exit.** When an employee’s agent proves useful, IT helps turn it into a supported tool, which keeps the register honest.

## What to do this month

For a COO or CEO, four steps. First, ask IT for a list of every OAuth grant and API token held by an AI tool or integration across email, CRM, code and file storage, and revoke the ones nobody can explain. Second, pick the three agents with the widest reach and run the one-page review on each, starting with the trifecta check. Third, set up the sandbox and the register before you write any new AI policy, so the policy has somewhere to send people. Fourth, ask your security lead or outside tester to plant instructions in a document one of your agents reads next week, and look at what it did.

## More notes

29 October 2026 6 min read

## Who owns what your AI learns.

Y Combinator now asks for startups that help companies own their intelligence. Before a mid-sized company owns a model, it can own the four things every model works with: context, evals, rules and connections.

26 October 2026 9 min read

## Delete the step first and give the agent whatever survives.

Musk’s five-step method puts automation last, and most AI programs start there because an agent is the one step a vendor can sell. I walk accounts payable through the steps in his order and show why an agent that clears exceptions fast hides the steps that should go.

## Your agents need a critic and so does the plan they carry out.

Models grade their own work too kindly, and the labs now separate the agent that makes from the agent that checks, the way finance separates maker and checker. I set out a four-layer review design with a minutes budget, and why the brief itself needs a critic with no stake in it.