Ssrf on t0ul

A web-search tool that hits a local server

Tue, 16 Dec 2025 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

The first tool that reaches out

Everything the agent has done so far is passive. It reads email, writes an inert file, draws a page. This post gives it the first tool that acts on the outside world on its own: a web search, something that takes a URL and fetches it. That is a small feature and a large change, because the URL does not come from me. It comes from the model, which built it after reading an email I do not control. A tool that will fetch whatever URL it is handed, driven by a model that can be talked into handing it anything, is server-side request forgery, and this is the post where the agent first has the power to commit it.

Defeating the lethal trifecta

Tue, 10 Mar 2026 00:00:00 +0000

Three legs

Simon Willison gave the pattern its name: the lethal trifecta is an agent that has all three of access to untrusted content, access to private data, and the ability to act or communicate outward. Each alone is fine. An agent that reads your email but can only draft replies is harmless; so is one that holds secrets but never sees an attacker’s words. Put all three in one process, though, and an instruction hidden in the untrusted content can walk a secret out the door.

Action links

Tue, 30 Jun 2026 00:00:00 +0000

The one thing that acts

Two posts ago the agent learned to tag a link in an email as an action, kept separate from the quiet to-do list precisely so a human would see it. This post is about what happens when someone actually acts on it. An action link is the single most dangerous thing the agent handles, because following it is a real outbound request: it can carry data out of the house, or reach inward to something only the machine can see. Every other feature so far produced text; this one produces a network call.