With agents this is not a theoretical question. The agent acts in your name: if it can reach your inbox, your files and the internet all at once, then a hijacked agent can do exactly as much damage as you could. Least privilege is the only defence that still works after the model has been successfully fooled.
The literature identifies three ingredients that together make up a successful data leak: private data, untrusted content and an outbound channel. Any two of them are safe on their own — all three together are not. And this is not theory: a survey of 7,973 live servers found that 40.55% of them expose their tools without any authentication.
The most common misconception is that this is a developer question. It is not: the decision is a business one. You are the one who has to decide what the agent may reach and what it may not — and that decision matters more than which model you pick.
How to separate things in practice is the subject of the least-privileged agent, a separate article. The directly related terms: prompt injection, human in the loop and sandbox.