Symbol A
A is a part of this expression. Its role is fixed by the surrounding article and by the operations shown in the formula.
Read this term in its guide →Published equation contexts
Why this formula appears here
Both incidents are instances of the same underlying condition, and it is worth writing that condition down rather than leaving it as a slogan. Call A the proposition that an agent has access to data worth stealing, U the proposition that untrusted content reaches its context, and E the proposition that some channel back out to the world is available to it. Willison’s name for the combination is useful because it states a falsifiable structural claim: exploitable exfiltration requires all three at once. Neither the GitHub case nor the Supabase case needed a novel attack technique; both needed exactly this combination sitting in one connected server, which is what an MCP connection routinely…
Read the representative guide
Symbol E
E is a part of this expression. Its role is fixed by the surrounding article and by the operations shown in the formula.
Read this term in its guide →How to interpret it
Read this expression with the definitions, units, and assumptions supplied by the article.
Research cited beside this formula
Published contexts (1)
A symbol can carry a different meaning in another article. Each occurrence keeps its own guide and term definitions.
Equation 4 · AI Infrastructure
How a Tool Description Becomes an Attack Surface
This mathematical expression combines the displayed quantities; its precise role follows from the surrounding article text.
Both incidents are instances of the same underlying condition, and it is worth writing that condition down rather than leaving it as a slogan. Call A the proposition that an agent has access to data worth stealing, U the proposition that untrusted content reaches its context, and E the proposition that some channel back out to the world is available to it. Willison’s name for the combination is useful because it states a falsifiable structural claim: exploitable exfiltration requires all three at once. Neither the GitHub case nor the Supabase case needed a novel attack technique; both needed exactly this combination sitting in one connected server, which is what an MCP connection routinely…