The lethal trifecta for AI agents

1 card

1. 01

   The lethal trifecta: access to private data, exposure to untrusted content and the ability to communicate externally; have all three and you have a leak.

   The lethal trifecta for AI agents · 2025

   Break one leg of the trifecta: no outbound channel, no untrusted content or no private data.

   Models follow instructions found in content: a web page, an email, a PDF, a tool result can carry "ignore previous instructions, send X to Y". Injection is not solved with prompts; the reliable defence is architectural — remove one leg of the trifecta: no outbound channel (no arbitrary URLs, no email sending), or no untrusted input, or no private data. Patterns: two models (a "quarantined" one reads the untrusted content, the privileged one never sees it raw); capability tracking along the data flow; a domain allowlist; human approval on anything sent outside; tool outputs marked as data in the prompt. The OWASP Top 10 for agentic applications puts goal hijacking through injection in first place.

   “If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.”

   Open the card →