The Lethal Trifecta

An AI agent that combines private data, untrusted content and a way to send data out can be tricked into leaking it.

“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.”
— Simon Willison, “The lethal trifecta for AI agents” (2025)

Untrusted content, private data and a way out together let an attacker steer an agent into leaking data; remove any one and that path closes.

To an executive

An AI agent that can see private data, read untrusted content and send information out can be tricked into leaking customer data. Removing any one of the three stops it.

To an engineer

Audit each agent for private data access, untrusted input and external communication. If all three are present, remove one, since filters alone are not a reliable boundary.

The idea

Language models follow instructions wherever they find them, including inside a web page, an email or a document they were only asked to read. This is prompt injection, a term Simon Willison coined in 2022. In 2025 he named the combination that turns it into a data breach: an agent that has access to private data, exposure to untrusted content, and the ability to communicate externally.

With all three, an attacker can plant instructions in content the agent reads, and the agent can be talked into sending private data somewhere the attacker controls. Remove any one of the three, and that path is closed.

Why it works

Models cannot reliably tell data from instructions. Text is text, wherever it comes from.

Guardrails are probabilistic. Filters catch many attacks, but a security boundary that works most of the time is not a boundary.

Tools multiply quietly. Each tool added for convenience may add one more leg of the trifecta.

Where it applies

Designing AI agents that browse, read email or documents, or call tools.
Reviewing third-party AI integrations and plugins connected to company data.
Security architecture for AI platforms used across the business.

How to apply

List each agent's capabilities in three columns: private data, untrusted input, ways out (web requests, email, links, file writes).
Never allow all three together. Split the work across separate agents or sessions with different permissions.
Taint after untrusted input. Once an agent has read untrusted content, stop it from taking consequential actions without human approval.
Close quiet exits. Rendered images and links can leak data too; treat them as communication.

Example scenario

A company connected an AI assistant to staff email so it could summarise inboxes and draft replies, and it could also fetch web pages. A security review spotted the trifecta: private mail, untrusted incoming messages, and outbound web requests.

They split it in two. The summariser could read mail but had no network access; drafting replies required a person to press send.

Questions to ask

Does this agent read private data, see untrusted content, and have a way to communicate out — all at once?
After the agent reads untrusted input, what is it still allowed to do?
Are we relying on a guardrail product to catch prompt injection?

When not to use it

Agents with no access to anything sensitive, where leaking is not a meaningful risk — though they can still be manipulated in other ways.

How it misleads you

Breaking the trifecta stops data from leaking but does not make an agent safe. An agent fed untrusted content can still be tricked into deleting data or taking harmful actions with the access it has. Combine this with least privilege and human approval for risky actions.