Databricks Omnigent Blocks AI Agent Data Exfiltration

Databricks has detailed a new security method using Omnigent contextual policies to neutralize what security researcher Simon Willison calls the lethal trifecta. This vulnerability occurs when a single AI agent session combines access to private data, exposure to untrusted content, and the ability to communicate externally. Individually, these capabilities are harmless and necessary for routine tasks. However, when combined, they allow malicious actors to use prompt injection to hijack the agent and exfiltrate sensitive corporate information.

Traditional authorization systems evaluate security permissions one isolated action at a time, which fails to detect this multi-step threat. Omnigent solves this by tracking the state of all three legs throughout an active session. A human administrator configures these boundaries beforehand so the AI cannot alter its own security rules at runtime. If an agent accesses private data and ingests untrusted content during a session, the policy automatically blocks any subsequent outbound communication attempt.

To demonstrate, Databricks highlighted a support automation agent handling customer ticket 4417. An attacker can plant a malicious instruction inside the ticket, directing the agent to pull confidential figures from an internal document named revenue-q3 and email them to an external address, audit.archive@review-mail.io. Without contextual tracking, the agent executes the command because each individual action is technically authorized. With Omnigent, the system recognizes that both the private-data and untrusted-content legs have been activated, prompting it to block the outbound email.

This context-aware approach prevents false positives during normal operations. For instance, if the same agent handles a routine password-reset ticket, it only interacts with untrusted user input without accessing sensitive internal databases. Because only one leg of the trifecta is activated, the agent can successfully send the outbound email. Omnigent allows developers to define these policies based on specific tools or by inspecting call arguments, such as distinguishing between internal and external web addresses.