Your AI agent can read your private Slack messages, browse the web, and send emails on your behalf. It feels productive. It is also one prompt injection away from forwarding your credentials to an attacker.
That combination of capabilities is what security researcher Simon Willison calls the lethal trifecta. It is the single most important security concept every developer building AI agents needs to understand in 2026.
- Access to private data such as emails, databases, internal documents, or API keys
- Exposure to untrusted content like web pages, user-submitted text, emails from unknown senders, or third-party tool outputs
- The ability to take outbound actions such as sending messages, writing files, making API calls, or executing code
When an agent has all three, an attacker can embed hidden instructions inside the untrusted content. The agent reads those instructions, treats them as legitimate commands, accesses the private data, and takes an outbound action to exfiltrate it. This attack vector is called prompt injection, and the lethal trifecta is what makes it devastating.
"Any AI agent that can read your secrets, browse the internet, and take action on your behalf is one clever prompt away from betraying you."
Why Two Out of Three Is Safe
The lethal trifecta is specifically about the combination. Remove any one leg and the risk drops dramatically.
| Combination | Risk Level | Why |
|---|---|---|
| Private data + untrusted content (no actions) | Low | The agent might get confused but cannot act on malicious instructions |
| Private data + outbound actions (no untrusted content) | Low | No attack surface for prompt injection since all inputs are trusted |
| Untrusted content + outbound actions (no private data) | Low | Even if tricked, the agent has nothing valuable to exfiltrate |
| All three combined | Critical | Full attack chain: inject, access, exfiltrate |
This is what makes the concept so useful for agent design. It gives you a clear framework for evaluating risk. If your agent needs all three capabilities, you know exactly where to focus your security effort.
The 98 Percent Problem
According to assessments conducted across production AI agent deployments, approximately 98 percent of agents evaluated exhibit the lethal trifecta. Nearly every agent that developers ship today combines private data access, untrusted input processing, and outbound action capability.
This is not because developers are careless. It is because the most useful agents are the ones that do all three things. An email assistant that cannot read your emails, process incoming messages, and send replies is not very useful. A code agent that cannot access your repository, read documentation, and commit changes is barely functional. This is a core tension in AI-driven development.
The very features that make agents valuable are the same features that make them exploitable. That tension sits at the heart of AI agent security.
Lethal Trifecta Examples with MCP Tools
The Model Context Protocol has made it trivially easy to give agents new capabilities through tool servers. Each MCP server you connect adds new powers to the agent, and many of them complete the trifecta without anyone noticing.
Example 1: Slack Plus Web Browsing
You connect a Slack MCP server (private data access) and a web browsing tool (untrusted content exposure). The Slack server also lets the agent send messages (outbound action). A malicious web page could contain hidden text instructing the agent to read your Slack DMs and post them to a public channel.
Example 2: Database Plus Email
Your agent connects to a PostgreSQL MCP server with read access to customer data (private data). It also processes incoming support emails (untrusted content) and can send reply emails (outbound action). A crafted support email could trick the agent into querying customer records and including them in the response.
Example 3: Code Repository Plus Package Registry
A coding agent has access to your private repository (private data), reads package documentation from the internet (untrusted content), and can commit and push code (outbound action). A poisoned README in a dependency could instruct the agent to insert a backdoor into your codebase. This is related to the broader problem of secure code generation.
"Every MCP server you connect is another leg of the trifecta. Most developers stop counting after the second one."
How to Break the Lethal Trifecta
You cannot always avoid all three capabilities. But you can architect your agent to minimize the risk. Good software architecture is the first line of defense. The goal is to break the chain so that even if prompt injection succeeds, the damage is contained.
Separate Agents by Trust Boundary
Instead of one agent that does everything, use multiple agents with different permission levels. The agent that processes untrusted web content should not be the same agent that has access to your private database. Keep the attack surface and the crown jewels in different processes. This mirrors how AI guardrails work at the model level.
Gate Outbound Actions with Human Approval
The cheapest way to break the trifecta is to require human confirmation before any outbound action. The agent can read private data and process untrusted content, but it cannot send an email, make an API call, or write a file without the user clicking approve. This turns the third leg from automatic to manual.
Sanitize Untrusted Inputs
Strip or isolate untrusted content before it enters the agent's context. If you are processing emails, extract only the structured fields and discard freeform text that could contain injection payloads. If you are browsing the web, use a tool that returns only the visible text content, not hidden HTML attributes or comments. Understanding how context shapes responses helps here.
Apply the Principle of Least Privilege
Give the agent only the minimum permissions it needs for each task. Read-only database access instead of read-write. Send-only to specific recipients instead of arbitrary email addresses. Commit to a branch instead of pushing directly to main. Every permission you withhold is one less capability an attacker can abuse. This is especially important when agents handle cybersecurity tasks.
The Lethal Trifecta as a Design Checklist
Before you ship any AI agent, run through this quick audit.
- Does the agent access private or sensitive data? List every source.
- Does the agent process content from untrusted or external sources? List every input channel.
- Can the agent take actions that affect external systems? List every outbound capability. Think of this like a code review for permissions.
- If all three answers are yes, which leg is easiest to remove or gate?
This takes five minutes and can prevent a breach that takes months to recover from. The lethal trifecta is not a theoretical risk. It is the default architecture of nearly every AI agent being built today. Understanding concepts like agent drift and context rot adds further depth to your security posture.
Conclusion
The lethal trifecta is the combination of private data access, untrusted content exposure, and outbound action capability in a single AI agent. Coined by Simon Willison and found in roughly 98 percent of assessed agents, it is the architectural pattern that makes prompt injection attacks devastating rather than merely annoying. The fix is not to avoid building capable agents but to break the chain by separating trust boundaries, gating outbound actions, sanitizing inputs, and applying least privilege. Teams that also manage verification debt catch these risks earlier. Every MCP tool you connect, every data source you expose, and every action you enable should be evaluated through this lens.
