“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.”Simon Willison · The lethal trifecta for AI agents · 2025 · The lethal trifecta for AI agents (simonwillison.net, 16 iunie 2025) — după enumerarea celor trei capabilități
Break one leg of the trifecta: no outbound channel, no untrusted content or no private data.
Models follow instructions found in content: a web page, an email, a PDF, a tool result can carry "ignore previous instructions, send X to Y". Injection is not solved with prompts; the reliable defence is architectural — remove one leg of the trifecta: no outbound channel (no arbitrary URLs, no email sending), or no untrusted input, or no private data. Patterns: two models (a "quarantined" one reads the untrusted content, the privileged one never sees it raw); capability tracking along the data flow; a domain allowlist; human approval on anything sent outside; tool outputs marked as data in the prompt. The OWASP Top 10 for agentic applications puts goal hijacking through injection in first place.
Why it matters Every new tool is a new leg of the trifecta; check at every addition, not at launch.