Three Properties That Make an Agent Exploitable: The Lethal Trifecta and the Rule of Two

Three teams deploy the same email assistant with the same model, and the same hostile web page reaches all three. In each, the model accepts the page's text as an instruction and tries to send the user's private messages to an attacker.

Teams A and B lose nothing, while Team C's assistant sends the messages to the attacker. The model behaved identically in every case, so it cannot explain the result. What differed, and how can you test for it before an attacker does?