Lethal Trifecta
An AI agent security risk model proposed by security researcher Simon Willison. It states that when an agent simultaneously has access to private data, exposure to untrusted text, and a channel for transmitting data externally, it is highly susceptible to exploitation by prompt injection attacks, leading to data leakage.
Core Facts
Timeline (last 90 days)
The 'fatal triad' of security is: access to private data, exposure to untrusted tokens, and the existence of a data exfiltration channel.
Security researcher Simon Willison named the risk pattern of simultaneously possessing all three capabilities—access to private data, exposure to untrusted text, and a channel for exfiltrating data—the 'lethal trifecta'.
Access to private data, exposure to untrusted text, and a channel for exfiltrating data are each safe in isolation; it is only when combined that they constitute a vulnerability.
Reliable defenses should be structural — that is, removing one leg of the fatal triad — and Willison considers the data exfiltration path to be the easiest leg to remove.
If all three capabilities must remain enabled, agents should be split: an isolated model with no tools handles untrusted text, and the agent with permissions never sees that text.
Simon Willison summarized the root cause of prompt injection risk as the "fatal triad": private data, untrusted content, and external communication—when all three are present, incidents will occur, and the solution is to eliminate one of them.
All Facts (6)
Security researcher Simon Willison named the risk pattern of simultaneously possessing all three capabilities—access to private data, exposure to untrusted text, and a channel for exfiltrating data—the 'lethal trifecta'.
65%UnverifiedThe 'fatal triad' of security is: access to private data, exposure to untrusted tokens, and the existence of a data exfiltration channel.
50%UnverifiedAccess to private data, exposure to untrusted text, and a channel for exfiltrating data are each safe in isolation; it is only when combined that they constitute a vulnerability.
50%UnverifiedReliable defenses should be structural — that is, removing one leg of the fatal triad — and Willison considers the data exfiltration path to be the easiest leg to remove.
50%UnverifiedIf all three capabilities must remain enabled, agents should be split: an isolated model with no tools handles untrusted text, and the agent with permissions never sees that text.
50%UnverifiedSimon Willison summarized the root cause of prompt injection risk as the "fatal triad": private data, untrusted content, and external communication—when all three are present, incidents will occur, and the solution is to eliminate one of them.
50%