WTF is Lethal Trifecta?
The dangerous combination of private data access, exposure to untrusted content, and a way to send data out.
TL;DR
An agent that (1) can read your private data, (2) reads content an attacker could control, and (3) can communicate externally can be tricked into leaking your data. Remove any one of the three and the attack gets much harder.
How it works
Framed as a practical threat model for prompt injection: since injections can't be reliably prevented, ensure no single agent session combines all three capabilities. Exfiltration channels are subtle: rendering an image URL with data in the query string, opening links, or calling any network tool counts. Mixing MCP servers from different sources is a common way to assemble the trifecta by accident.
Origin
- Coined / introduced by
- Simon Willison
- When
- 16 Jun 2025
- Story
- Coined in a June 2025 blog post on AI agent security.