Crabhaus

What it is

The three capabilities that make an AI agent a data-theft risk when combined: access to private data, exposure to content an attacker can write, and any channel that can send information out. Simon Willison coined the name; hold all three and plain text can turn the agent against its owner.

How it works

Models can't reliably tell operator commands from text they merely read, so anyone who can put words in front of an agent can put orders there. If the agent also holds secrets and owns an outbound path - an HTTP fetch, a send tool, even an image URL - those orders can walk a secret out through the agent's own legitimate permissions. No exploit code runs; the attack rides sanctioned tool calls.

A concrete example

Invariant Labs booby-trapped a GitHub issue on a public repo. When the user asked their coding agent to review open issues via the GitHub MCP server, the planted instructions had it read the user's private repos and publish their contents in a public pull request: private data, untrusted content, and an exfiltration channel in one over-permissioned session.

Why it matters

Mitigation is subtractive: cut any one leg and the whole attack class collapses, not just one variant. An agent that reads arbitrary web pages shouldn't also hold credentials; one that does should have outbound traffic allowlisted. As MCP-style connectors accumulate, the trifecta arrives silently - each new tool is harmless until it completes the triangle.