Meta's Rule of Two: The Fix for Agent Prompt Injection
The two-of-three rule that snaps the AI agent prompt injection chain, why it works, and the three seams where it still leaks.
TL;DR: Meta’s Rule of Two says one agent gets at most two of three dangerous powers in a session: read untrusted input, touch sensitive data, talk to the outside world. Drop the third and the prompt injection chain can’t complete. It’s the best practical move shipping today. It also leaks in three spots Meta names in its own limitations section, right as a 14-author paper walked through 12 rival defenses at 90%-plus.
What Is Meta’s Rule of Two?
So here’s the whole thing on one napkin. An agent may hold no more than two of three dangerous properties at once. Meta published it on October 31, 2025, and the framing is about as blunt as security gets. Three buckets, labeled the way Meta labels them.
[A] process untrusted input inbound email, scraped web, RAG docs
[B] access sensitive systems the inbox, prod configs, source, secrets
[C] change state or communicate send mail, hit a URL, write to a DB
Pick two. Drop the third. That’s it. The lineage runs straight back to Chromium’s old Rule of 2 for untrusted input, and to Simon Willison’s lethal trifecta, which named the same three circles a few months earlier and which we walked in full in our agentic AI attack breakdown. Meta’s tweak was folding “change state” into “communicate externally,” which drags a whole class of write-action abuse under the same rule. And Meta says the quiet part out loud: until somebody figures out how to reliably catch prompt injection, this is the move. They’re not selling a fix. They’re selling a constraint.
Why the Rule of Two Breaks the Prompt Injection Chain
The Rule of Two works because prompt injection needs a full chain, and pulling any single link kills the whole run. Walk Meta’s own email-bot scene. A spam message lands in the inbox with a hidden instruction: grab the private contents of this mailbox, then forward them to me. For that to pay off, the bot needs all three legs. It reads the hostile email [A]. It reaches the private inbox [B]. It sends mail outbound [C]. Untrusted input flows to sensitive data flows to the exfil pipe. A to B to C. That’s the chain.
Now snap a link. Run it [BC], where the bot only ingests mail from a trusted-sender allowlist, so the payload never reaches the context window. Run it [AC], where the bot lives in a sandbox with no real data, so the injection fires into an empty room. Run it [AB], where outbound sits behind a human reading the draft, so the stolen data has nowhere to go.
Same attack, three different walls. And every wall is a hard property of the architecture, not a classifier squinting at a string wondering if it looks shady.
That’s the part worth sitting with. Most “AI security” products try to detect the bad prompt. The Rule of Two doesn’t care if the prompt gets through, because the agent physically can’t finish the heist. You saw the exact reasoning failure one layer down in our MCP tool poisoning breakdown: the model can’t tell trusted metadata from hostile metadata, so you stop trying to win that fight and constrain what the popped model can reach instead. Assume breach, shrink blast radius. It’s the same containment doctrine we ran through the CIA triad for LLM security, just wearing a cleaner label.
How Real Agents Run the Rule of Two
Real agents satisfy the rule by dropping the riskiest leg for the job and gating it behind a control. Meta sketches three, and they’re worth naming because each one shows a different leg going down.
Travel assistant runs [AB]. Searches the web, touches booking data, so [C] gets clamped: human confirmation on every reservation, and a hard refusal to visit any URL the agent built itself.
Web research agent runs [AC]. Fills forms, hits arbitrary URLs, so [B] gets stripped: the browser runs in a sandbox with no preloaded session cookies.
Internal coding agent runs [BC]. Touches prod, writes changes, so [A] gets locked: author-lineage filtering on every data source before it enters context.
There’s a slicker move buried in the post, too. An agent can transition between configs mid-session, but only as a one-way door. Start in [AC] to pull from the open internet, then permanently kill the comms channel before flipping to [B] and touching internal systems.
session start: [A C] scrape the web, no sensitive access
latch: kill [C] one-way, no going back
config now: [A B] touch internal systems, comms dead
The latch has to be one-way, and this is the whole trick. The moment an agent can flip [C] back on, you’ve handed it all three again and rebuilt the chain you just broke. A blast door you can re-open from the inside isn’t a blast door. It’s a hallway.
And that latch, those sandboxes, the trusted-sender allowlist, all of it assumes the seams hold. They don’t always. Meta says so itself, in a section most people skim right past.
The Three Seams Where the Rule Still Leaks
The Rule of Two leaks in three places, and Meta names every one in its own limitations section. This is the part that doesn’t make the LinkedIn posts.
Seam one: the [AC] pair isn’t actually safe. Meta’s first diagram labeled every two-way overlap “safe.” Willison pushed back the same weekend it dropped, and he’s right. An agent with untrusted input and the power to change state, but no access to private data, can still wreck the place. It corrupts records, fires destructive writes, spams outbound. No secrets required. Meta quietly swapped “safe” to “lower risk” after the pushback. That edit is the whole story. The rule cuts severity. It doesn’t zero it.
Seam two: it’s scoped to one session, and your agent remembers. The rule governs what an agent holds inside a single session. But the nastiest agentic failures live across sessions. An agent that forgets its constraints between runs. Cross-session data bleed. Residual context from the last user surfacing in the next one. A one-way latch does nothing about poisoned state that persists into tomorrow’s session. The rule is a snapshot. The attack is a movie.
Seam three: the human-in-the-loop fallback rots into blind clicking. When an agent genuinely needs all three, Meta’s escape hatch is human approval. Fine on paper. In the field you get alert fatigue, and the operator rubber-stamps the interstitial without reading it, which Meta flags directly as a known failure mode. A checkpoint everyone clicks through blind is a vuln wearing a seatbelt.
So how confident are you that a constraint gets you to safe? Right around when you’re feeling good about it, a 14-author crew led by Milad Nasr dropped “The Attacker Moves Second” and put 12 published prompt-injection defenses through adaptive attacks that were allowed to iterate. Most fell at over 90 percent, and most had originally reported near-zero. The pure human red-team run cracked all of them. The Rule of Two isn’t on that list, because it isn’t a detector. It’s the concession that detectors keep losing.
Up next: steps you can take right now and a field-ready security prompt. Thanks for rolling with ToxSec. Let’s get operational.
