Analysis
The lethal trifecta for AI agents: private data, untrusted content, and external communication
Publication date unknown · Discovered simonwillison.net
Page published
Publication date unknown · First observed: 12 Nov 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
The lethal-trifecta framework helps defenders identify dangerous combinations of agent capabilities and reduce exposure by separating private-data access, untrusted inputs, and outbound communication.
Alex Ewerlöf’s “The Lethal Trifecta” explains Simon Willison’s framework for prompt-injection risk: combining private-data access, exposure to untrusted content, and external communication can enable data theft through AI agents. Attacker-controlled instructions embedded in emails, web pages, or documents can redirect an agent to retrieve and transmit private information.