MCP Colors
A riff off of the lethal trifecta for addressing prompt injection, this is a simple heuristic to ensure security at runtime
red = untrusted content
blue = potentially critical actions
An agent can't be allowed to do both
timkellogg.me/blog/2025/11...
MCP Colors
View original threadinspired by reactions from this one bsky.app/profile/timk...
Rule of Two: fighting prompt injection
@simonwillison.net posted on a new phrasing of the Lethal Trifecta that changes one node to “externally communicate OR change state”
in my own work, my version was “OR perform critical actions”
simonwillison.net/2025/Nov/2/n...
@simonwillison.net posted on a new phrasing of the Lethal Trifecta that changes one node to “externally communicate OR change state”
in my own work, my version was “OR perform critical actions”
simonwillison.net/2025/Nov/2/n...
1