For Board · Heads-of · Practitioner
Lethal Trifecta
Simon Willison's name for the combination of three capabilities that makes an AI agent exploitable for data theft: access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three can be made to send private data to an attacker.
- AI agents
- prompt injection
- data exfiltration
- agent security
- Simon Willison
The three legs
Private data: the agent can read email, files, records or anything else an attacker wants. Untrusted content: the agent reads material an attacker can influence, such as a web page, an inbound email or a shared document. External communication: the agent can send data out, by email, by an API call, or even by rendering a link or image whose address carries the data.
Why it is useful
It turns a hard question (is this agent secure against prompt injection?) into a simple one that a board or an architect can answer from a design diagram. Because no current defence reliably stops prompt injection, an agent with all three legs should be assumed exploitable.
What to do with it
Remove a leg. Most agents do not need all three for every task: separate the agent that reads untrusted content from the one that holds private data, or remove external communication from any run that touches both. Where all three are unavoidable, require human-in-the-loop review before anything leaves. The register risks are sensitive information disclosure and excessive agency in autonomous agents.
Sources
Related Terms
Agentic AI
An AI system that pursues a goal by deciding for itself which actions to take, in what order, using tools and other systems it has been given access to, with a person checking some or none of the steps. The governance change is that the unit of risk stops being a single output and becomes a sequence of actions with consequences.
Excessive Agency
Giving an LLM-based system more functions, permissions or autonomy than its task needs, so that a manipulated or mistaken output becomes a damaging action. It is LLM03 in the OWASP Top 10 for LLM Applications 2026, up from sixth place in 2025.
Model Context Protocol (MCP)
An open protocol for connecting AI applications to external tools and data through servers that expose tools, resources and prompts. It has become the standard way to give an AI agent access to other systems, which makes its trust model the agent's attack surface: every connected server can steer the model as well as serve it.
Prompt Injection
An attack in which untrusted content reaching a language model is interpreted as instructions rather than data, causing the model to act on an attacker's intent instead of the operator's. It is a property of how the application assembles its context, not a flaw in any particular model.