Analysis
The lethal trifecta for AI agents: private data, untrusted content, and external communication
Publication date unknown · Discovered simonwillison.net
Page published
Publication date unknown · First observed: 26 Oct 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Agents combining sensitive-data access, untrusted inputs, and outbound tools require architectural boundaries to limit prompt-injection-driven data theft.
Simon Willison’s “lethal trifecta” describes the prompt-injection risk created when AI agents combine private-data access, exposure to untrusted content, and external communication. The article revisits this established risk and advocates architectural restrictions that prevent successful injections from becoming data-exfiltration paths, rather than relying on model behavior alone.