Skip to content
Call wiki

What actually protects you when an agent has your files — and how real is prompt injection?

Last updated 2026-08-17 · Confidence: documented — vendor security docs, a threat-intel report, and Dropbox’s help center; the credential-upload refusal is a tried first-hand test, and “no documented end-user harm yet” is inferred from the absence of published cases.

What protects you isn’t the agent’s word — it’s approval prompts before risky actions, hard limits on what it can touch, and a recovery layer (version history or git) for when something slips through.

Prompt injection: many demos, thin record of real harm

Section titled “Prompt injection: many demos, thin record of real harm”

Prompt injection hides malicious instructions in content the agent reads; models “will happily follow any instructions that make it to the model”, whatever the source. The vulnerabilities are real in production systems — EchoLeak (CVE-2025-32711), a zero-click exfiltration flaw in Microsoft 365 Copilot Microsoft rated critical, was disclosed and patched in June 2025, one of dozens of researcher-found exploits.

Actual attacks are only starting: Unit 42’s December 2025 report is the first observed in-the-wild injection payload — a scam site carrying instructions aimed at AI ad-reviewers — and even there no successful compromise is confirmed. So the record still shows no documented case of a personal agent injected to real harm, but payloads now circulate; treat that calm as dated, not permanent. Risk concentrates where three things meet — private data, untrusted content, a channel out (“the lethal trifecta”); removing one leg, e.g. by scoping connectors, defuses it.

Safeguards that don’t rely on the model

Section titled “Safeguards that don’t rely on the model”

Asking the agent to promise (“guarantee you’ll never delete my files”) is just another instruction — no protective prompt holds “every time” against infinite phrasings. Vendors instead build enforcement outside the model, per Claude Code’s security docs:

  • approval prompts for anything beyond read-only;
  • writes confined to the working folder;
  • sandboxed commands and command-injection detection (see Sandbox vs full access);
  • web fetches in an isolated context window.

Approval modes catch real cases: in a live test (2026-08-01), an agent in approve-before-acting mode refused a request to upload Google account credentials (tried — a one-off; see Permission modes for what each mode gates).

The recovery layer

Section titled “The recovery layer”

Dropbox version history restores edits and deletions for 30 days on Basic/Plus/Family (180 on Professional/Standard, 365 on Business Plus/Advanced), and Rewind rolls a folder or the whole account back to a point in time. The Plus plan is the 2 TB, $9.99/month tier. Limits: permanently deleted files are unrecoverable, cloud-native docs (Google Docs, Paper) aren’t versioned, and only files inside the synced folder count. Git gives the same undo per project with unlimited history, at a steeper learning cost.

Q&A from calls

Section titled “Q&A from calls”

Is Dropbox enough of a safety net for letting an agent loose on your files? Against file damage — bad edits, mass deletion — yes, within the plan’s window (30 days on Plus): version history and Rewind undo it. It does nothing against exfiltration: a secret copied out can’t be rolled back. Keep credentials outside the synced folder and lean on approval prompts for that half of the risk.

Sources

Section titled “Sources”