Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies
Databricks introduces a contextual policy in Omnigent to block AI agents from combining legitimate capabilities that enable data theft, addressing the 'lethal trifecta' of private data access, untrusted content exposure, and external communication.
Databricks has unveiled a contextual policy in Omnigent designed to prevent AI agents from inadvertently combining three ordinary capabilities—access to private data, exposure to untrusted content, and external communication—that together enable data exfiltration. The policy monitors session activity, blocking the third capability only when the first two are already active, thereby disrupting the sequence before data can leave the system. Traditional authorization checks, which evaluate actions individually, fail to detect this threat because no single step appears malicious on its own.
The policy operates by tracking which capabilities a session has already used. For example, an agent reading an internal document and processing an untrusted support ticket would light two 'legs' of the trifecta. If the agent then attempts to send an email containing sensitive data, the policy intervenes, denying the outbound call while allowing all other actions. This approach ensures normal operations continue uninterrupted, as the policy targets the combination of capabilities rather than the tools themselves.
Support automation is a common use case for AI agents, where a ticket might instruct the agent to read private data and send an email. An attacker could embed malicious instructions in a ticket, such as directing the agent to retrieve internal revenue figures and email them to an external address. Without the policy, the agent would comply, exfiltrating data through a series of legitimate actions. With the policy enabled, the agent reads the ticket and internal document but is blocked from sending the email, preventing the data leak.
The policy is configured by humans, who define which tools or arguments constitute private data or untrusted content, ensuring the agent cannot alter these classifications at runtime. This prevents prompt injection attacks from bypassing the safeguards. The lethal-trifecta policy joins two existing contextual policies in Omnigent—session-risk scoring and intent-based authorization—all running in the same policy engine to address different risk patterns while leveraging shared session state.