lethal trifecta
In plain wordsA rule of thumb for AI assistants: one that can see your private data, reads material from outsiders and can send messages out can be manipulated by those outsiders into handing your data over.
The combination of three capabilities in an AI agentAI agent, n.: An AI system that does not just answer but acts: given a goal, it decides on steps, uses tools such as a browser or code editor, checks the results and keeps going until the job is done. or LLM application that makes data theft through prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger. possible: access to private data, exposure to untrusted content, and the ability to communicate externally (sending email, making web requests, or rendering links and images that load remote URLs). When all three are present, instructions plantedindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it. in the untrusted content can steer the agent to collect the private data and transmit it through the outbound channel. Since injections cannot yet be reliably blocked, the proposed defense is architectural: remove at least one leg for any given task, for example by cutting off external communication once untrusted content has entered the context. The concept is widely used in agent-security design, notably for tool ecosystems built on the Model Context ProtocolModel Context Protocol, prop. n.: An open standard that lets AI assistants plug into outside apps and data — files, calendars, databases, business software — through one common connector instead of a custom link for every pairing; often likened to a USB-C port for AI., where users can unwittingly assemble all three.
That setup is a lethal trifecta: the agent reads your inbox, processes mail from anyone and can post to the web.
Origin
Coined by Simon Willison in a blog post of 16 June 2025, 'The lethal trifecta for AI agents: private data, untrusted content, and external communication', building on his writing about prompt injection since 2022. Meta's 'Agents Rule of Two' (31 October 2025) generalized it beyond data theft: until prompt injection can be reliably stopped, an agent session should combine at most two of processing untrustworthy input, accessing sensitive systems or private data, and changing state or communicating externally.
Related
- prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger.
- indirect prompt injectionindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it.
- excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage.
- tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.
- AI agentAI agent, n.: An AI system that does not just answer but acts: given a goal, it decides on steps, uses tools such as a browser or code editor, checks the results and keeps going until the job is done.
- confused deputyconfused deputy, n.: A security flaw in which a trusted program does an outsider's bidding with its own access rights, because it cannot tell whose request it is serving; AI agents are prone to it.
Sources
- Willison, S. (2025). The lethal trifecta for AI agents: private data, untrusted content, and external communication. Blog post, 16 June 2025. simonwillison.net/2025/Jun/16/the-lethal-trifecta
- Meta AI (2025). Agents Rule of Two: A Practical Approach to AI Agent Security. Meta AI blog, 31 October 2025. ai.meta.com/blog/practical-ai-agent-security
Mentioned in
prompt injectionprompt injection, n.: Tricking an AI system by slipping in text that it mistakes for instructions — for example, a hidden line in an email telling an AI assistant to forward the user's messages to a stranger., indirect prompt injectionindirect prompt injection, n.: A prompt-injection attack in which the trick instructions are hidden in content the AI reads on its own — a web page, an email, a file — rather than typed by the person using it., OpenClawOpenClaw, prop. n.: A free, open-source AI helper that lives on a computer you control; you send it requests by text message, through apps such as Telegram or Signal, and it acts for you in your email, calendar and files., sandboxsandbox, n.: A sealed-off computer space where an AI agent can run programs and change files without being able to harm the real system, reach private data or contact the outside world unless allowed., clawclaw, n.: Nickname for an always-on personal AI assistant, like OpenClaw, that lives on your own computer and does jobs for you whenever you message it., confused deputyconfused deputy, n.: A security flaw in which a trusted program does an outsider's bidding with its own access rights, because it cannot tell whose request it is serving; AI agents are prone to it., excessive agencyexcessive agency, n.: Giving an AI system more power than its job needs — too many tools, too-broad permissions or too little human sign-off — so that a mistake or a trick can do real damage., Simon WillisonSimon Willison, prop. n.: A British programmer and blogger, co-creator of the Django web framework, whose widely read writing on language models coined 'prompt injection' and the 'lethal trifecta'., tool poisoningtool poisoning, n.: Hiding harmful instructions in the description of a tool an AI assistant can use, so the assistant obeys them when it reads the tool's details, even though the user never sees them.