Lethal Trifecta
An agent combining private-data access, exposure to untrusted content, and external communication is practically undefendable against prompt injection.
Plain English
If your agent can read your secrets, see attacker-controlled text, and talk to the outside world, assume a crafted message can leak the secrets.
Example
A mail assistant that reads your inbox, parses incoming email, and can send calendar invites is the textbook trifecta - one malicious email away from leaking your contacts.
Why it matters
It is a fast design-level security test: break any one leg - sandbox the network, isolate untrusted content, restrict egress - and the exfiltration chain fails.