Lethal trifecta

The lethal trifecta, a term popularized by developer Simon Willison, names three capabilities that are risky in combination: access to private data, exposure to untrusted content such as web pages or incoming emails, and the ability to communicate externally, such as sending messages or loading URLs.

If an agent has all three, an attacker can hide instructions in untrusted content that tell the agent to gather private data and send it somewhere. Because models cannot reliably tell trusted instructions apart from malicious ones, prompts alone cannot fully prevent this.

The practical defense is to break the triangle. Remove at least one leg for any given agent or session, or put a human approval step in front of the external communication.