How does Perplexity Comet and Dia not suffer from data leakage like this? They seem to completely violate the lethal trifecta principle and intermix your entire browser history, scraped web page data and LLM’s.
Yet
Or have they? How would you find out? Have you been auditing your outgoing network requests for 1x1 pixel images with query strings in the URL?
These opinions are my own blah blah blah
There are currently no fully general solutions to data exfiltration, so things like local agents or computer use/interaction will require new solutions.
Others are also researching in this direction; https://security.googleblog.com/2025/06/mitigating-prompt-in... and https://arxiv.org/html/2506.08837v2 for example. CaMeL was a great paper, but complex.
My personal perspective is that the best we can do is build secure frameworks that LLMs can operate within, carefully controlling their inputs and interactions with untrusted third party components. There will not be inherent LLM safety precautions until we are well into superintelligence, and even those may not be applicable across agents with different levels of superintelligence. Deception/prompt injection as offense will always beat defense.
I wrote notes on one of the Google papers that blog post references here: https://simonwillison.net/2025/Jun/15/ai-agent-security/
I've read the CaMeL stuff and it's good, but keep in mind it's just "mitigation", never "prevention".
See sibling-ish comments for thoughts about what we need for the future.