What does this equation mean?

Both incidents are instances of the same underlying condition, and it is worth writing that condition down rather than leaving it as a slogan. Call A the proposition that an agent has access to data worth stealing, U the proposition that untrusted content reaches its context, and E the proposition that some channel back out to the world is available to it. Willison’s name for the combination is useful because it states a falsifiable structural claim: exploitable exfiltration requires all three at once. Neither the GitHub case nor the Supabase case needed a novel attack technique; both needed exactly this combination sitting in one connected server, which is what an MCP connection routinely provides once it is granted read access to something private and any means of writing somewhere visible. That framing is not decoration. Every mitigation discussed below is legible as an attempt to make one of the three terms false, deliberately, at a layer the model’s own behavior cannot override.