Analysis · curated 24 Sep 2026
The lethal trifecta for AI agents: private data, untrusted content, and external communication
First reported simonwillison.net
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
The lethal trifecta framework gives defenders a clear mental model for spotting when an AI agent's combination of capabilities creates a data-exfiltration risk from indirect prompt injection.
A course lesson explains the "lethal trifecta" concept coined by security researcher Simon Willison, describing how an AI agent that simultaneously holds access to private data, exposure to untrusted content, and an outbound communication channel can be tricked via prompt injection into exfiltrating sensitive data. The piece describes how removing any one of the three capabilities breaks the exfiltration circuit and references real-world exploits against Microsoft 365 Copilot, GitHub's MCP server, and GitLab Duo.