Analysis · curated 31 Jul 2026
The lethal trifecta for AI agents: private data, untrusted content, and external communication
First reported · updated · 4 reports simonwillison.net
Coverage timeline
Why it matters
MCP-connected agents that combine private-data access, untrusted input, and outbound communication can be trivially tricked into exfiltrating data, and defenders need architectural mitigations because prompting alone cannot separate data from instructions.
An explainer on stopping prompt injection in MCP servers frames the problem as the 'lethal trifecta' (private-data access, exposure to untrusted content, and external communication) coined by Simon Willison, using the Invariant Labs demonstration against GitHub's official MCP server as its central case. In that attack a malicious GitHub issue embedded agent-directed instructions that caused a coding agent to leak private repo details into a public pull request, with no exploited code or CVE. The piece argues the fix is architectural rather than prompt-based.