Lethal trifecta
Simon Willison's name for three powers that are dangerous together: access to your private data, exposure to untrusted content, and a way to send data out. With all three, a stranger's text can steal your data. Remove any one and that attack has no route.
It turns an unsolved problem into a design question you can answer today. You can't guarantee a model won't be fooled, but you can list its tools and see whether all three legs are there.
Say it to your agent
“This agent reads support tickets, which is untrusted, and it can read the customer table, which is private. So remove its web and email tools, restrict the network to our own API, and have its replies go to a draft a person sends.”