Meta’s Rule of Two Limits AI-Agent Prompt-Injection Risk

Summary

The article explains Meta’s Rule of Two, which limits agents to two of three risky capabilities: untrusted input, sensitive data access, and external communication. It also discusses cross-session leakage, risky capability overlaps, and weak human approval.

Key points

• The Rule of Two limits an agent in a session to two of three capabilities: processing untrusted input, accessing sensitive data, and communicating externally.
• The approach aims to interrupt prompt-injection attack chains through architectural constraints rather than prompt-classification detection.
• Examples include restricting input to trusted senders, isolating agents from private data, and requiring human review before outbound actions.
• The article notes that some two-capability combinations can still allow harmful actions, such as destructive changes, even without access to secrets.
• The rule is scoped to a single session and may not address persistent or cross-session state leakage.
• Human approval may provide weak protection when users become fatigued and approve warnings without reviewing them.

People