AI Vocabulary · 07 When It Goes Wrong
What is Lethal Trifecta?
The dangerous combination of private data, untrusted content and a way to send data out in one AI agent.
The lethal trifecta is a rule of thumb by the developer Simon Willison. An agent becomes dangerous when it combines three things: access to private data, exposure to content an attacker can control, such as web pages or incoming emails, and a way to communicate externally, such as sending emails or loading links.
With all three, a hidden instruction in a document, a case of prompt injection, can make the agent collect private data and send it to the attacker. Models cannot yet reliably tell instructions from data, so Willison advises avoiding the full combination instead of relying on filters.
Why it matters for you
Many useful setups contain all three parts without anyone noticing: an assistant that reads your inbox, browses the web and can send messages. Each connector you add can complete the combination and lead to data leakage.
Own it
Before you connect a new tool, check the three parts. If an agent reads untrusted content and sees private data, remove its outbound channel or require approval for every message it sends.
Where it comes from
Simon Willison described the concept in The lethal trifecta for AI agents: private data, untrusted content, and external communication (16 June 2025).
Related
Your AI Learning Hub
Learn the whole AI Vocabulary, step by step, and build with it. Build it. Own it.