Lethal Trifecta
Lethal Trifecta
Simon Willison's diagnostic framework for identifying LLM/agent deployments that are exploitable-by-design. The lethal trifecta is the combination of three properties in one agent:
- Access to private data
- Exposure to untrusted content
- A channel that can send data back out (network calls, comments, emails, etc.)
Any single property is defensible. Any two are recoverable. All three simultaneously = the deployment is structurally exfiltratable via prompt injection, and no amount of scanning at the output boundary will fully close it.
Surfaced in the Enterprise Information Security Reddit Practitioner Research 2026-08-03 corpus via GitLost — a 2026-07-07 r/netsec disclosure that fully exemplifies the pattern. See Agentic Exfiltration for the class of attacks the trifecta enables.
Why this framing survives — the boundary is architectural, not linguistic
The corpus's sharpest one-liner (u/sunychoudhary [↑103] on the Anthropic three-org compromise thread):
"A system prompt is not an egress policy. If an agent must stay inside an evaluation range, that boundary has to exist in the network, credentials and tooling — not in the model's understanding of the scenario."
This is why the trifecta matters as a design constraint rather than a mitigation checklist:
- Property 1 (private data access) lives in the credential scope the agent was handed.
- Property 2 (untrusted content) lives in the retrieval / input surface the agent connects to.
- Property 3 (outbound channel) lives in the network egress + tool-call permissions the agent has.
Fix any single vertex and the triangle collapses. Scope the token narrower; restrict which authors' content the agent will act on; gate outputs behind human review. Any one of these breaks the class.
Recognizing the trifecta in a real deployment
| Ask | If yes | Property |
|---|---|---|
| Can the agent read anything a user with its credentials couldn't see externally? | Yes → property 1 present | Private data access |
| Does the agent process content that untrusted parties can author or influence? | Yes → property 2 present | Untrusted content |
| Can the agent post, email, upload, comment, commit, or otherwise emit content externally? | Yes → property 3 present | Outbound channel |
Three "yes" answers = the deployment is a trifecta and needs at least one vertex removed.
Anti-patterns the corpus flagged
- Scope tokens per tool, not per server. MCP-server registries are enumerating this: "Stand up a registry as the source of truth — every server declares its owner, exposed tools, and the token scope each tool runs under." — u/whatwilly0ubuild
- A repo-scoped PAT beats an org-scoped PAT. GitLost worked because the org handed the agent an org-wide read token; scoping the integration PAT to one repo would have collapsed property 1.
- Threat-detection scanners are a backstop, not a boundary — GitHub had a scanner and it missed. "Additionally," prefixed to the malicious instruction was enough.
- Test the trifecta empirically, not on paper. "Feed the MCP-connected agent an injected instruction through whatever ingests untrusted content and see what tool calls it actually attempts, not just what the token theoretically allows." — u/Ok_Divide6777
Cross-vault convergence
The trifecta arrives in a vault that already carries:
- Prompt Injection — the technique. The trifecta is the precondition that makes indirect prompt injection catastrophically effective.
- Autonomous AI Cyberattack — the sandbox-escape class (Anthropic Claude Mythos April 2026 + OpenAI Sol July 2026). The trifecta is a complementary attack class: no sandbox-escape needed, the model stays inside its intended sandbox and still exfiltrates because the three properties were present.
- AI Vulnerability Discovery — the trifecta is the enterprise-side design constraint that pre-empts most of the vulnerabilities agentic-scanning would otherwise find in deployed agents.
Cross-links
- Agentic Exfiltration — the concrete attack class the trifecta enables (GitLost + the same-class precedents).
- Prompt Injection — the injection technique that operationalizes the trifecta.
- Autonomous AI Cyberattack — the complementary attack class (sandbox escape).
- Enterprise Information Security Reddit Practitioner Research 2026-08-03 — corpus provenance.
Follow-ups
- Watch for Simon Willison to publish an authoritative artifact naming the trifecta by that specific phrase — currently cited via secondary reference in the r/netsec GitLost writeup rather than from a primary Willison source we've captured.
- Watch for a first CISO-published deployment-review template built around the three-vertex test — would move the framework from analyst vocabulary into procurement/governance.
- Watch for the first regulator (SEC, NIS2 successor, California AG) to reference the trifecta in enforcement guidance.