The Lethal Trifecta: Is Your AI Agent Exploitable?

The lethal trifecta is a term coined by researcher Simon Willison in June 2025 for the combination of three agent capabilities that together create a data-exfiltration risk: access to private data, exposure to untrusted content, and the ability to communicate externally. Each capability on its own is normal and often necessary. An agent that can read your private data is useful; one that reads external content is useful; one that can send messages is useful. The danger is only in having all three at once, because then an attacker who can influence the untrusted content can hide an instruction in it that tells the agent to fetch private data and send it out through the external channel. The concept is valuable precisely because it is so concrete: rather than worrying vaguely about AI security, you can check any agent against three specific criteria and know whether it is exposed to this particular, serious attack. It also points directly at the fix, since removing any one of the three ingredients closes the exfiltration path. That is why it has become one of the most widely used mental models for anyone deploying AI agents, and why it belongs at the center of an agent security review rather than as an afterthought.

It is dangerous because of a fundamental property of how large language models work: they have no reliable boundary between data and instructions. When an agent reads an email, a web page, a document, or the output of a tool, that text goes into the same context the model uses to decide what to do next. If the text contains a command, the model may follow it, because to the model there is no firm line between content it was asked to handle and instructions it was told to obey. This is called prompt injection, and OWASP lists it as LLM01, the top risk in its Top 10 for LLM Applications. The lethal trifecta is what turns prompt injection from a nuisance into a breach. On its own, an injected instruction can only make the model say or do something within its available capabilities. But when the agent also has access to private data and a way to communicate externally, that injected instruction can direct it to steal and leak information. The danger is compounded by how hard it is to fix at the model level, because reliably teaching a model to ignore instructions embedded in data it processes remains an unsolved problem. That is why the practical defense focuses on the agent’s capabilities, the three ingredients you can actually control, rather than on hoping the model resists every manipulation.

The clearest documented example is EchoLeak, disclosed in June 2025 and tracked as CVE-2025-32711, a vulnerability in Microsoft 365 Copilot rated 9.3 out of 10 in severity. Copilot had all three ingredients of the trifecta by design: it could access a user’s private emails and documents, it ingested incoming emails as content, and it had ways to communicate outward. Researchers at Aim Security showed that an attacker could send a victim a single, normal-looking email that contained instructions hidden in the formatting, for example in HTML comments or invisible text, so the human never saw them. When Copilot processed the email, it read those hidden instructions as commands, and by chaining several bypasses the attack could make Copilot pull the user’s private data and exfiltrate it, all with zero clicks from the victim. It was the first documented case of prompt injection being weaponized for concrete data theft in a production AI system, rather than just a proof of concept. Microsoft patched the specific chain server-side and reported no exploitation in the wild. The important lesson is that the underlying weakness was not a single coding bug that a patch permanently removes, it was the lethal trifecta itself, which is why the same pattern can reappear in any agent that has all three capabilities.

Run a three-column audit on each agent you operate and look for the ones that check all three boxes. In the first column, list any private or sensitive data the agent can reach, defined by capability rather than intent: if it has a database connection, a file tool, or an authenticated integration, it has data access even if you never meant it to see anything sensitive. In the second column, list every source of untrusted content it ingests, meaning any text whose wording an outsider could influence. This is the column people underestimate, because it includes not just incoming emails and browsed web pages but uploaded files, product reviews, calendar invites, external API responses, and even file names. In the third column, list every way data could leave, which includes sending email, calling external APIs, posting to webhooks, and subtler channels like fetching an image from a supplied URL or writing to a shared document. Any agent with entries in all three columns is exploitable by prompt injection in principle and should go to the top of your remediation list. An agent missing one column is much safer against this specific attack, and you should note which column is empty because keeping it empty is your control. Re-run the audit whenever you add a capability, since a single new integration can silently complete the trifecta.

You break it by removing whichever one of the three ingredients the agent can most afford to lose, because eliminating any single leg closes the exfiltration path. To reduce private-data access, apply least privilege: give the agent access only to the specific data its task requires, not a broad connection to everything, so a hijacked agent can reach very little. To reduce untrusted-content exposure, control what the agent ingests and treat anything from outside your trust boundary as hostile input rather than trusted instruction, though you can rarely eliminate this leg entirely for a useful agent. To cut external communication, the most practical and powerful control, restrict outbound actions to a fixed allow-list of known-safe destinations, or require human approval before the agent can send anything out. For most business agents the outbound leg is the one to clamp hardest, because it is both controllable and the last barrier before data actually leaves; an agent that physically cannot send data to an attacker-controlled destination is contained even if it is manipulated. The honest limit is that breaking the trifecta closes this specific data-exfiltration path, it does not eliminate prompt injection or make the agent secure against everything else, so pair it with active injection containment, logging, and bounded agent design. Still, because it is simple and high-leverage, breaking the trifecta is one of the best security decisions you can make for any agent.

No, and it is important to be honest about that. Breaking the lethal trifecta closes one specific and serious attack path, the data exfiltration that becomes possible when an agent has private data access, untrusted content exposure, and external communication all at once. Removing any one of those ingredients means an injected instruction can no longer complete the chain of read private data then send it out, which is a genuinely important win. But it does not make the agent secure against everything. Prompt injection itself remains possible and unsolved in general, so even an agent with a broken trifecta can be manipulated into taking wrong or harmful actions within whatever capabilities it still has. There are also other risks unrelated to the trifecta, such as the agent making costly mistakes on its own, being given excessive autonomy, or its supporting infrastructure being compromised. So the right way to think about the trifecta audit is as one essential, high-value layer in a broader agent security program, not as a complete solution. Combine it with active prompt-injection containment, strict logging so you can see what the agent read and did, human approval on consequential actions, and an overall design that keeps agents bounded and their actions verifiable. The trifecta gives you the single clearest test for whether an agent can leak your data, and breaking it removes that path, but safety comes from the layers together, not from any one control.