Agents Rule of Two: A Practical Approach to AI Agent Security
Meta's Oct 2025 framework stating that agents must satisfy no more than two of: (A) processing untrustworthy inputs, (B) access to sensitive data, (C) ability to change state externally, a deterministic architectural approach to bounding blast radius.
- from
- Prompt Injection
- added
- 2026-10-10
- likes
- 0
similar
-
OpenAI openai.com
Agent Security Enterprise (2026) - Assesses enterprise risk management frameworks for autonomous AI deployments across five core security principles. The guidance emphasizes zero-trust architectures, task-scoped authorization, and boundary enforcement to contain blast radius…
-
AI Agents in Depth github.com
-
Agent Threat Rules (ATR) github.com
An open MIT detection-rule standard for AI-agent and MCP attacks (prompt injection, tool poisoning, context exfiltration), like Sigma or YARA for the agent layer, with OWASP LLM/Agentic and MITRE ATLAS mappings on each rule.
-
New Prompt Injection Papers: Agents Rule of Two and The Attacker Moves Second simonwillison.net
Simon Willison's Nov 2025 commentary on both landmark papers, including the finding that 12 published defenses were bypassed at >90% success rate using gradient descent and RL-based adaptive attacks.
-
Securing AI Agents Against Prompt Injection Attacks arxiv.org
Nov 2025 benchmark of 847 adversarial test cases across 5 attack categories against 7 LLMs. The combined defense framework reduces attack success from 73.2% to 8.7% while retaining 94.3% of baseline task performance.
-
Design Patterns for Securing LLM Agents against Prompt Injections simonwillison.net
Overview of various strategies to mitigate the risk of prompt injection.
Prompt Injection › Introduction Resources: “Meta's Oct 2025 framework stating that agents must satisfy no more than two of: (A) processing untrustworthy inputs, (B) access to sensitive data, (C) ability to change state externally, a deterministic architectural approach to bounding blast radius.”