ControlLoopStart free trial

Find the agent that can read your data, take orders from strangers, and send it out

Each capability is reasonable on its own: a support agent reads customer records, ingests inbound tickets, and sends replies. Together they mean one poisoned ticket can tell the agent to send customer data anywhere.

Start free trial Get the CLI on GitHub

Team: 7 days free, then $199 a month per organization. Cancel any time. Compare plans →

Three safe permissions, one unsafe agent

Prompt injection turns untrusted input into instructions. An agent that can also read sensitive data and talk to the outside world needs no further vulnerability to leak it: the attacker writes the request, and the agent carries it out with its own access.

The combination rarely arrives in one change. The data access came last quarter, the ticket integration last month, and the email tool in this pull request. Reviewing each change alone never shows the whole path.

What ControlLoop reports on the pull request
Agent capability path · support-agent
  reads      customers-db            restricted data
  receives   inbound-tickets         untrusted input
+ sends      email via sendgrid      external communication
policy.exfiltration-triangleCritical

support-agent now combines sensitive-data access, untrusted input, and outbound communication.

×
ControlLoop gateDeployment blocked
EXIT 1

What ControlLoop reports

One finding, not three

The exfiltration triangle is reported as a single critical finding, worked out from the agent's capability graph rather than by matching names or content.

Destructive and financial actions

A change that newly gives an agent a destructive or financial action, directly or through a newly connected agent or tool, is reported as high with the path that delivers it.

Writes to sensitive data without approval

A write to a resource classified confidential or restricted, with no approval in the manifest, is reported. An expired approval does not count.

How it works

  1. 01

    Map every path

    ControlLoop builds an Agent Capability Bill of Materials covering direct and transitive access: tools, servers, identities, and delegated agents.

  2. 02

    Classify what matters

    Mark sensitive resources in controlloop.yaml, or let adapters report the data classes they can see.

  3. 03

    Block the third leg

    When a change completes the triangle, the gate blocks it and names the agent and all three legs.

Questions

Is this the same as the "lethal trifecta"?

Yes. It is the same idea: private data, untrusted content, and a way to communicate externally in one agent. ControlLoop calls it the exfiltration triangle and detects it structurally from the capability graph.

Does ControlLoop inspect prompts or model output?

No. It evaluates capability evidence from configuration and code structure. It never reads prompt text, and no model decides the verdict.

What if the agent gets one leg through another agent?

Delegation is part of the graph. An agent that can hand work to another agent inherits what that agent can reach, and the finding shows the path.

Go deeper

Read the guide: What is an Agent Capability Bill of Materials (ACBOM)?

More use cases