← All Terms

Rule of Two

Meta's design rule that an AI agent should hold no more than two of three capabilities in one session: processing untrusted input, accessing sensitive systems or data, and changing state or communicating externally.

Agentic AI

The Agents Rule of Two is a security rule Meta published in October 2025, building on Simon Willison’s lethal trifecta. An agent may read untrusted content, reach sensitive systems or data, or act and communicate externally, but in any one session it should hold no more than two of the three. If a task genuinely needs the third, a person approves that step.

The rule exists because prompt injection has no reliable fix. A model cannot consistently tell its user’s instructions from text it reads, so any agent holding all three capabilities can eventually be steered into fetching sensitive data and sending it out. Removing one capability closes that path whatever the agent has been persuaded to believe.

In practice the rule is a design review question with a yes or no answer. List the three capabilities for each agent; where all three appear, cut the cheapest one, usually outbound communication behind an egress allow-list or an approval step.

Read more on this
Security

Put Boundaries Around Autonomy: Practical Controls for Rogue Agent Risk

If an AI agent can always be fooled some of the time, the controls that matter limit what it can do when it is. Maria Singh and I set out five autonomy tiers, the hard limits that hold outside the model, human approval that is more than a rubber stamp, kill switches that have been tested, and a 90-day plan for banks and government agencies. Part 3 of 3 on rogue AI agents.

Security

When AI Agents Go Off Script: How Websites Become Targets

More than half of web traffic is now automated, and a growing share of it is AI agents acting for someone. Agents attack websites at machine speed, and websites can hijack the agents that read them. Maria Singh and I set out both routes, the cases that prove them, and why banks and government agencies carry the most risk. Part 1 of 3 on rogue AI agents.