Lethal trifecta
An AI agent that has private data, reads untrusted content and can send data out can be tricked into leaking that data.
Simon Willison named it in June 2025. Each capability is ordinary on its own: reading the inbox, opening a web page, calling an API. Together, an instruction hidden in an email or a page can tell the agent to collect private data and send it out, through a link, an image URL or a tool call. Models cannot reliably tell instructions from data, so filters that catch most attacks are not enough.
Related terms
- Prompt injection: Instructions hidden in data (a web page, an email, a file) that the model follows as if they came from you.
- Excessive agency: An AI agent with more tools, permissions or autonomy than its task needs, so a mistake or an injected instruction can do real damage.
- Tool poisoning (MCP): An attack that hides instructions in a tool’s name, description or output, so an agent using that tool follows the attacker instead of the user.
- Agent sandbox: An isolated environment where an AI agent runs code and commands without access to your network, secrets or real files.
