Simon Willison

Also agents cannot trust any data whatsoever they add to their context.

This puts reading email for example as a risk.

Probably not impossible to create a worm that convinces a claw to forward it to every email address in that inbox.

And then exfiltrate all the emails.

Then do a bunch of password resets.

Then get root access to your claw.

But not just email. Github issues, wikipedia, HN etc. may be poisoned.

See https://simonw.substack.com/p/the-lethal-trifecta-for-ai-agents but there may be more trifectas than that in a claw driven future.

My approach is to publish to my own blog at https://simonwillison.net and then copy and paste content from that into a Substack newsletter at https://simonw.substack.com a few times a month.

It's been working really well.

Substack don't have an API, but they do support copy and paste - so I built myself a tool that assembles my blog content into rich text I can copy and paste straight into the Substack editor.

I wrote about how that works here: https://simonwillison.net/2023/Apr/4/substack-observable/

> The victim uploads a file to Rovo that contains a hidden prompt injection

Yeah this attack is possible on all modern agentic systems.

* Access to your private data

* Exposure to untrusted content

* The ability to externally communicate in a way that could be used to steal your data

(https://simonw.substack.com/p/the-lethal-trifecta-for-ai-agents)

And blocking it wholesale reduces usefulness of the agent so it is a tradeoff.

Original @simonw article here:

https://simonw.substack.com/p/the-lethal-trifecta-for-ai-agents

https://simonwillison.net/2025/Aug/9/bay-area-ai/

Discussed:

https://news.ycombinator.com/item?id=44846922