{"id":14563,"date":"2026-10-18T19:09:01","date_gmt":"2026-10-18T17:09:01","guid":{"rendered":"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/"},"modified":"2026-10-18T19:09:11","modified_gmt":"2026-10-18T17:09:11","slug":"reddit-comment-ai-assistant-business-risk-triangle","status":"publish","type":"post","link":"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en","title":{"rendered":"Could a Reddit comment turn your AI assistant against your business?"},"content":{"rendered":"<article lang=\"en\">\n<header>\n<p class=\"eyebrow\">AI agent security \u00b7 A decision guide for small and mid-sized businesses<\/p>\n<h1>Could a Reddit comment turn your AI assistant against your business?<\/h1>\n<p class=\"standfirst\">A seemingly ordinary comment encountered during web research can contain an instruction that tries to divert an assistant from its task. The risk depends on its permissions: can it also access a confidential folder and send information out? The comment grants no new access. Content the assistant reads is not permission to act.<\/p>\n<\/header>\n<section aria-labelledby=\"scenario\">\n<h2 id=\"scenario\">The scenario: web research encounters a Reddit comment<\/h2>\n<p><strong>This is a fictional illustration, not a report of a verified Reddit incident or a customer incident.<\/strong> A sales manager asks an assistant to research and compare solutions before a meeting. During its web research, the assistant encounters a seemingly ordinary Reddit comment. It also has access to an internal folder containing commercial proposals and a tool for sending information out.<\/p>\n<p>In this example, the comment contains a malicious instruction that tries to pass itself off as an authorised work instruction. It attempts to misuse the assistant\u2019s access to the confidential folder and its ability to transmit information. If the assistant treats it as permission and the controls allow it, it may retrieve a confidential proposal and attempt to send it outside the company. The problem is the use of existing permissions, not new rights granted by the comment.<\/p>\n<p>A leak is not automatic or inevitable. It depends on the permissions, available tools and checks applied to each action. Public web content can enter an assistant\u2019s context without being addressed to the business at all. Being encountered during research gives it no authority over the task.<\/p>\n<p>This is <strong>indirect prompt injection<\/strong>: instructions arrive inside material the AI was supposed to treat as data\u2014such as a comment, web page, document or, in other workflows, an email\u2014and attempt to change its behaviour. <a href=\"https:\/\/genai.owasp.org\/llmrisk\/llm01-prompt-injection\/\">OWASP describes this risk<\/a> and notes that connecting a model to a document retrieval system does not eliminate it.<\/p>\n<\/section>\n<section aria-labelledby=\"triangle\">\n<h2 id=\"triangle\">Three capabilities that can create a path for data to leave<\/h2>\n<p>In his article dated 16 June 2025, <a href=\"https:\/\/simonwillison.net\/2025\/Jun\/16\/the-lethal-trifecta\/\">Simon Willison calls this combination the \u201clethal trifecta\u201d<\/a>. It is a useful model for reviewing connected assistants, not a way to calculate the likelihood of an attack.<\/p>\n<ul>\n<li><strong>Private data:<\/strong> the assistant can access documents, customer records or internal conversations.<\/li>\n<li><strong>Untrusted external content:<\/strong> it reads comments, web pages or files whose instructions you do not control. \u201cUntrusted\u201d means the content has no authority to direct the assistant, not that every source is malicious.<\/li>\n<li><strong>The ability to send information out:<\/strong> it has a way to transmit data beyond the business, such as an email or sharing tool.<\/li>\n<\/ul>\n<figure>\n<a href=\"https:\/\/say-digital.io\/blog\/wp-content\/uploads\/2026\/10\/reddit-assistant-risk-triangle-en.png\"><img src=\"https:\/\/say-digital.io\/blog\/wp-content\/uploads\/2026\/10\/reddit-assistant-risk-triangle-en.png\" width=\"1080\" height=\"1440\" loading=\"lazy\" alt=\"Triangle connecting private data, untrusted external content and the ability to send data out. Risk emerges from their combination. Removing one element reduces this risk but does not guarantee complete safety.\" \/><\/a><figcaption>Original SAY Digital illustration, adapted from Simon Willison\u2019s model. The triangle identifies a risky combination; it is not a safety certification. Open the image to enlarge it.<\/figcaption><\/figure>\n<p>In our fictional example, the Reddit comment encountered during research provides the external input, the sales folder provides the private data and the transmission tool provides the route out. Bringing all three into one workflow creates a path for diversion if permissions and controls allow it.<\/p>\n<\/section>\n<section aria-labelledby=\"limits\">\n<h2 id=\"limits\">Two elements do not mean \u201cno risk\u201d<\/h2>\n<p>Removing one capability may break this particular chain of data leakage. It does not prevent every harmful outcome. An assistant that cannot send email can still write a misleading draft. One with no access to confidential records can still take an unauthorised business action if it has other permissions.<\/p>\n<p>\u201cCannot send\u201d also needs checking. Disabling email is not enough if another tool can publish, share or transmit information. Review the routes by which data can leave, not just the connector names.<\/p>\n<p>Running a model locally does not remove its tools\u2019 permissions either. Keeping inference on your hardware and controlling what an assistant can access or transmit are separate decisions.<\/p>\n<\/section>\n<section aria-labelledby=\"decisions\">\n<h2 id=\"decisions\">What should you authorise before connecting the assistant?<\/h2>\n<p>Comparing solutions on the web does not require access to sales folders or permission to send their contents out. Adding internal context may require access to a specific folder, without permission to transmit it. Use the following decision guide to separate these tasks before granting access.<\/p>\n<div class=\"decision-grid\">\n<section class=\"decision\">\n<h3>Researching and comparing on the web<\/h3>\n<p><strong>Business decision:<\/strong> allow access to relevant public sources, without automatic transmission or broad access to sensitive folders.<\/p>\n<p><strong>Evidence to request:<\/strong> the assistant completes the comparison without following instructions in comments or pages it reads, opening unrelated documents or transmitting information.<\/p>\n<\/section>\n<section class=\"decision\">\n<h3>Drafting a reply using internal information<\/h3>\n<p><strong>Business decision:<\/strong> limit access to the necessary documents and produce a draft. A person checks both the content and the recipient before sending.<\/p>\n<p><strong>Evidence to request:<\/strong> approval covers the exact message and any attachments, not a general permission to \u201ccontinue\u201d.<\/p>\n<\/section>\n<section class=\"decision\">\n<h3>Sending without human review<\/h3>\n<p><strong>Business decision:<\/strong> keep this autonomy narrow: defined message categories, permitted data and recipients. If the system cannot enforce those limits, keep the workflow in draft mode.<\/p>\n<p><strong>Evidence to request:<\/strong> tool-level controls block an out-of-scope transmission even if the model proposes it.<\/p>\n<\/section>\n<section class=\"decision\">\n<h3>Working on a confidential case file<\/h3>\n<p><strong>Business decision:<\/strong> restrict reading to the relevant file, close unnecessary routes out and name the person responsible for sensitive disclosures.<\/p>\n<p><strong>Evidence to request:<\/strong> access and sending attempts are traceable, and the team knows how to suspend the assistant when something goes wrong.<\/p>\n<\/section>\n<\/div>\n<p>Connectors and downstream systems must enforce these boundaries. They cannot exist only as instructions to the model. <a href=\"https:\/\/genai.owasp.org\/llmrisk\/llm062025-excessive-agency\/\">OWASP recommends least privilege, authorisation enforced by downstream systems and human approval for high-impact actions.<\/a> A rule such as \u201cnever disclose confidential data\u201d may guide the model, but it does not replace those controls.<\/p>\n<\/section>\n<section aria-labelledby=\"evidence\">\n<h2 id=\"evidence\">Ask for evidence on fictional data before extending access<\/h2>\n<p>The business owner and technical team should be able to verify three things: outside content cannot change the authorised task; an out-of-scope document remains inaccessible; and a sensitive transmission waits for the required approval. Run these checks with fictional data rather than exposing customer records to demonstrate the problem.<\/p>\n<p><a href=\"https:\/\/developers.openai.com\/api\/docs\/guides\/agent-builder-safety\">OpenAI\u2019s guidance on agent safety<\/a> recommends limiting the influence of untrusted data, structuring exchanges and using tool approvals. It also states that structure and isolation reduce risk without fully removing it. A successful test is therefore not a permanent guarantee. Recheck the boundaries when the tools, permissions or task change.<\/p>\n<p>For this research assistant, the Say Digital Framework starts with a specific choice: compare public sources only, also consult an internal folder or transmit the result? That choice sets the prototype\u2019s permissions and the refusals to verify before controlled deployment. If file sharing is added later, test the outbound controls again: the assistant now has a capability it did not have in the first trial.<\/p>\n<p>Adding a sending tool also changes who must approve the result before it leaves the business. Our <a href=\"https:\/\/say-digital.io\/blog\/hermes-agent-guide-ai-agents-business\/?lang=en\">guide to AI agents in business<\/a> explains the distinction between an agent\u2019s tools, its mission and human oversight.<\/p>\n<\/section>\n<aside class=\"cta\">\n<h2>Before connecting your assistant to the web and your records, define its permissions.<\/h2>\n<p>Start with one task: comparing solutions on the web, preparing a summary or finding a document in a case file. SAY Digital can help define the access, approvals and evidence you need before giving that assistant more autonomy.<\/p>\n<p><a href=\"https:\/\/say-digital.io\/\">Discuss your project with SAY Digital<\/a><\/p>\n<\/aside>\n<section class=\"sources\" aria-labelledby=\"sources\">\n<h2 id=\"sources\">Sources and limitations<\/h2>\n<p>Sources checked on 18 October 2026. The Reddit scenario is fictional: none of the sources cited here is presented as evidence of such a real incident. The business recommendations are an editorial synthesis, not a security certification or a report of a customer audit.<\/p>\n<ol>\n<li><a href=\"https:\/\/simonwillison.net\/2025\/Jun\/16\/the-lethal-trifecta\/\">Simon Willison \u2014 The lethal trifecta for AI agents<\/a>, 16 June 2025: the original three-capability model.<\/li>\n<li><a href=\"https:\/\/genai.owasp.org\/llmrisk\/llm01-prompt-injection\/\">OWASP \u2014 LLM01 Prompt Injection<\/a>: direct and indirect injection, and prevention limitations.<\/li>\n<li><a href=\"https:\/\/genai.owasp.org\/llmrisk\/llm062025-excessive-agency\/\">OWASP \u2014 LLM06 Excessive Agency<\/a>: minimum permissions, authorisation and human oversight.<\/li>\n<li><a href=\"https:\/\/developers.openai.com\/api\/docs\/guides\/agent-builder-safety\">OpenAI \u2014 Safety in building agents<\/a>: design guidance for its agent environment, not a guarantee that risk can be eliminated.<\/li>\n<\/ol>\n<\/section>\n<\/article>\n","protected":false},"excerpt":{"rendered":"<p>Fictional scenario: a Reddit comment tries to divert an AI assistant during web research. Decide which access, transmissions and controls to allow.<\/p>\n","protected":false},"author":2,"featured_media":14558,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_mi_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[164],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v15.7 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Reddit comments: a security risk for your AI assistant?<\/title>\n<meta name=\"description\" content=\"Fictional scenario: a Reddit comment tries to divert an AI assistant during web research. Decide which access, transmissions and controls to allow.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Reddit comments: a security risk for your AI assistant?\" \/>\n<meta property=\"og:description\" content=\"Fictional scenario: a Reddit comment tries to divert an AI assistant during web research. Decide which access, transmissions and controls to allow.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en\" \/>\n<meta property=\"og:site_name\" content=\"Say Digital I\/O\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-18T17:09:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-18T17:09:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/say-digital.io\/blog\/wp-content\/uploads\/2026\/10\/reddit-comment-ai-assistant-business-risk-triangle-cover.png\" \/>\n\t<meta property=\"og:image:width\" content=\"842\" \/>\n\t<meta property=\"og:image:height\" content=\"595\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Dur\u00e9e de lecture est.\">\n\t<meta name=\"twitter:data1\" content=\"6 minutes\">\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"https:\/\/say-digital.io\/blog\/#website\",\"url\":\"https:\/\/say-digital.io\/blog\/\",\"name\":\"Say Digital I\/O\",\"description\":\"Un site utilisant WordPress\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":\"https:\/\/say-digital.io\/blog\/?s={search_term_string}\",\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en#primaryimage\",\"inLanguage\":\"fr-FR\",\"url\":\"https:\/\/say-digital.io\/blog\/wp-content\/uploads\/2026\/10\/reddit-comment-ai-assistant-business-risk-triangle-cover.png\",\"width\":842,\"height\":595,\"caption\":\"AI assistant: control access and outbound actions\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en#webpage\",\"url\":\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en\",\"name\":\"Reddit comments: a security risk for your AI assistant?\",\"isPartOf\":{\"@id\":\"https:\/\/say-digital.io\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en#primaryimage\"},\"datePublished\":\"2026-10-18T17:09:01+00:00\",\"dateModified\":\"2026-10-18T17:09:11+00:00\",\"author\":{\"@id\":\"https:\/\/say-digital.io\/blog\/#\/schema\/person\/8ee0600139c147afbd1fa3ced079c557\"},\"description\":\"Fictional scenario: a Reddit comment tries to divert an AI assistant during web research. Decide which access, transmissions and controls to allow.\",\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/say-digital.io\/blog\/reddit-comment-ai-assistant-business-risk-triangle\/?lang=en\"]}]},{\"@type\":\"Person\",\"@id\":\"https:\/\/say-digital.io\/blog\/#\/schema\/person\/8ee0600139c147afbd1fa3ced079c557\",\"name\":\"Lia Amplify\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/say-digital.io\/blog\/#personlogo\",\"inLanguage\":\"fr-FR\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0a91149f1d8c7649e9d5060d658fb452?s=96&d=mm&r=g\",\"caption\":\"Lia Amplify\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","_links":{"self":[{"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/posts\/14563"}],"collection":[{"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/comments?post=14563"}],"version-history":[{"count":1,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/posts\/14563\/revisions"}],"predecessor-version":[{"id":14565,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/posts\/14563\/revisions\/14565"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/media\/14558"}],"wp:attachment":[{"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/media?parent=14563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/categories?post=14563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/say-digital.io\/blog\/wp-json\/wp\/v2\/tags?post=14563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}