Tools · Runs in your browser
AI Agent Attack-Surface Mapper
Every tool you give an agent widens what a prompt injection can do with it. List your agent's tools and MCP servers to see each path from planted instructions to stolen data or a hijacked action — and which change closes it.
Private data
Inboxes, databases, private repos, files — anything you wouldn't post publicly.
Untrusted input
Text an outsider can write: emails, web pages, issues, tickets, uploaded documents, invites.
A way out
Sending email or messages, HTTP requests, public comments — even a rendered image URL.
An agent with all three is exposed to the lethal trifecta (Simon Willison): instructions hidden in untrusted input can make it send your private data out.
1. Your agent's tools
Add every tool and MCP server the agent can call. Defaults are typical — adjust them to the scopes you actually granted.
Your inbox is private, and anyone in the world can put text into it by emailing you.
Customer and business records are the data an attacker wants.
Pages are attacker-controlled, and every request can carry data out in its URL.
2. Around the agent
Shipping an agent with real access?
I design and build AI agents with LangGraph and MCP — with scoped tools, sandboxed execution, approval gates, and egress controls built in from the start, not bolted on after an incident.
Related reading
How to Protect Your AI Application from Prompt Injections using Llama Guard and Next.js Edge Middleware
A practical 2026 guide to securing RAG and LLM applications against prompt injection and jailbreak attacks using Llama Guard, Ollama, Next.js Edge Middleware, and PostgreSQL-based threat logging aligned with the OWASP Top 10 for LLMs.
How to Build a Zero-Trust AI Sanitization Middleware in Node.js to Prevent Indirect Prompt Injection
Learn how to build a zero-trust sanitization middleware in Node.js and TypeScript using Express and js-tiktoken to defend against indirect prompt injection, enforce hard token limits, and stop untrusted RAG data from hijacking agentic tool calls.
Architecting Sandboxed Code-Execution Agents: Ephemeral Docker Runtimes, LangGraph, and Real-Time Telemetry in Next.js
Build a zero-trust, sandboxed AI coding agent with LangGraph, Ollama, and Claude Code that runs Python, C++, and JavaScript in ephemeral, network-restricted Docker containers on AWS Linux, with JWT execution policies, PostgreSQL audit trails, and live Socket.io telemetry in a Next.js workspace.
How to Implement Human-in-the-Loop (HITL) Approval Gates in LangGraph with PostgreSQL Checkpointers
Build production human-in-the-loop approval gates in LangGraph with AsyncPostgresSaver, interrupt_before, and Command-based resume flows.
Engineering Custom MCP Servers for Local AI Agents: Bridging PostgreSQL, MongoDB, and REST APIs with LangGraph and Next.js
A hands-on 2026 guide to building secure TypeScript MCP servers that connect local Ollama models and Claude Code to PostgreSQL, MongoDB, and REST APIs, orchestrated with LangGraph, streamed to a Next.js dashboard, and deployed with Docker and Nginx on AWS.
Frequently asked questions
What is the lethal trifecta?
A term coined by Simon Willison for an AI agent that combines three capabilities: access to private data, exposure to untrusted content, and a way to send data out. Any text the agent reads can contain instructions, and models can't reliably tell your instructions from an attacker's — so with all three present, a planted instruction can make the agent read your data and send it to the attacker.
Isn't a prompt-injection filter enough?
Filters and classifiers catch known patterns but not all of them, and an attacker only needs one that slips through. They're a useful layer, but the dependable fix is structural: make sure no single agent holds all three legs at once, or put a hard control such as an allowlist on the exit.
Why is human approval marked as gated rather than safe?
Approval works only while the approver reads each request carefully. When an agent asks for approval dozens of times a day, people start clicking yes, and a malicious request looks much like a normal one. Use approval for rare, high-impact actions, and prefer removing a leg for anything frequent.
How can a chat UI leak data on its own?
If the interface renders markdown images, a model tricked into writing  causes the browser to request that URL — and deliver the secret — the moment the message appears. No tool call is involved. Disable image rendering for model output, or proxy images through an allowlist.
What is the quarantined (dual-LLM) pattern?
Untrusted content is only ever read by a separate model that has no tools. It returns structured fields — a category, a date, an amount — never free text, so instructions inside the content can't reach the privileged agent that holds the tools. It costs flexibility, but it removes the untrusted-input leg.
Is my configuration stored anywhere?
No. Everything runs in your browser. The share link contains the map itself in the part of the URL after #, which browsers never send to a server.