The key risks to understand

Because agents act — not just talk — they carry risks a chatbot doesn't. You don't need to be technical to understand the big ones, and understanding them keeps you safe. (This is educational and defensive — no how-to-attack detail.)

1. Giving an agent too much access ("excessive agency"). The more tools, permissions, and freedom you give an agent, the more damage a mistake (or a manipulation) can do. An agent connected to your whole inbox, files, and accounts, allowed to act without asking, can send emails, delete files, or spend money based on one wrong decision. Security experts rank "excessive agency" among the top risks in AI applications for exactly this reason. The fix (next lesson): give agents only the access the task needs.

2. Hidden instructions in content the agent reads ("prompt injection"). Here's a subtle but important one: because an agent acts on the text it encounters, a malicious instruction hidden in that content — in a web page, an email, or a document it reads — can hijack it into doing something you never intended. The attacker doesn't need to reach you; they just plant an instruction in something the agent will read. This is a genuinely hard, unsolved problem, which is why oversight matters.

3. The "don't combine all three" rule (the "lethal trifecta"). Security researcher Simon Willison points out that risk spikes when a single agent has all three of these at once: (1) access to your private data, (2) exposure to untrusted content (the open web, emails), and (3) the ability to communicate externally (send messages, make requests). Put all three together and a hidden instruction in the untrusted content could trick the agent into taking your private data and sending it out. The simple, memorable rule: try not to give one agent all three at the same time.

What to take away:

• More access = more risk. Don't connect an agent to everything by default.
• Untrusted content is a vector — be cautious letting an agent with access to your private stuff freely act on web pages and emails.
• Watch for the trifecta — private data + untrusted content + external communication in one agent is the danger zone.

The mindset: agents act, so they carry real risks: giving them too much access ("excessive agency") means a mistake or manipulation can do real damage; hidden instructions in content they read ("prompt injection") can hijack them; and combining private-data access, untrusted content, and external communication in one agent (the "lethal trifecta") is especially dangerous. You don't need to fear agents — you need to limit their access, be cautious with untrusted content, and avoid the trifecta. The next lessons turn this into simple safe-use habits.