Analysis
The lethal trifecta for AI agents: private data, untrusted content, and external communication
First reported · Discovered · 2 reports simonwillison.net
Page published
Earliest dated coverage: 28 Oct 2026 · First observed: 11 Nov 2026 · Latest dated coverage: 28 Oct 2026
Coverage timeline
Why it matters
MCP deployments that combine private-data access, untrusted content, and external communication can enable prompt-injection-driven data theft, making tool permissions and separation important defensive controls.
eSEOspace’s MCP security guide explains prompt injection, tool poisoning, overly broad credentials, and risks from local servers. Drawing on Simon Willison’s “lethal trifecta,” the guide recommends least privilege, human approval for risky actions, and separating untrusted-content readers from tools that send data externally.