The lethal trifecta

Lesson 2 of 5 in The Agent Threat Model.

You cannot fix the token stream, so you need a way to decide which agent designs are survivable. The most useful one fits on an index card. Simon Willison published it on 16 June 2025 and named it the lethal trifecta.

Three capabilities. Combined in one agent, an attacker can trick it into stealing your data:

Access to your private data — the reason the agent is useful at all.
Exposure to untrusted content — anything an attacker can get in front of the model.
The ability to communicate externally — Willison calls this leg exfiltration.

Any two of these is a design you can defend. All three is an exfiltration chain waiting for a prompt, and the root cause is exactly the property from lesson one: models follow instructions wherever those instructions appear, because they cannot reliably tell trusted from untrusted text.

The three legs — and what each one actually is in your architecture

Leg 3 — external communication — the exfiltration channel
Any path by which bytes chosen by the model leave your boundary: an HTTP request, a rendered image URL, a markdown link a user might click, an outbound email, a comment on a public issue, a DNS lookup, a webhook. This is the leg vendors most often cut, because it is the most cuttable — the standard fix in real disclosures has been to lock down the rendering or the destination allowlist. Ask of every tool: can an attacker read the side effect?
Leg 2 — exposure to untrusted content — the injection surface
Anything the agent reads that an attacker can influence — and the honest inventory is always longer than the first draft. Note that "untrusted" does not mean "from the public internet": a CRM lead form, a support ticket, a PDF a customer uploaded, an internal wiki page anyone can edit, an MCP tool description, and another agent’s message all qualify. Content does not have to be visible to a human to be parsed by a model.
Leg 1 — access to private data — the prize
Whatever the agent’s identity can read: mailboxes, source repositories, CRM records, ticket histories, secrets in the environment, prior conversation state, memory written by earlier runs. Scope this by the task, not by the user — an agent inheriting a human’s full standing permissions is the most common unnecessary widening of this leg, and it is the leg least privilege attacks directly.

Read that pyramid as an architecture review, not a taxonomy. Count the legs. It takes about ninety seconds on a whiteboard, it needs no threat-intel feed, and it is the single highest-yield question you can ask about an agent design — including a design a vendor is selling you.

The reason counting works is that each two-leg combination has a named, boring failure mode instead of a catastrophic one.

What you get when you cut exactly one leg
Design	Legs present	What an attacker can still do	Why it is survivable
Cut external communication — private data + untrusted content, no egress	1 + 2	Corrupt the agent’s reasoning, produce wrong answers, poison memory for later runs.	The stolen data has nowhere to go. Integrity is still at risk; confidentiality is contained. Watch for accidental channels — a rendered image, a clickable link, a log an attacker can read.
Cut untrusted content — private data + egress, closed inputs	1 + 3	Nothing, until they find an input path you did not inventory.	Strongest of the three cuts if the inventory is honest. It usually is not — this is the cut that fails silently when someone adds a “summarise this ticket” feature six months later.
Cut private data access — untrusted content + egress	2 + 3	Make the agent send attacker-chosen content outward: spam, abuse, misinformation, requests to other systems.	No confidential data to steal. You have traded exfiltration for a reputational and abuse problem — real, but a different order of magnitude.
All three in one session	1 + 2 + 3	Read the private data and send it out, driven entirely by text the attacker planted.	Not survivable by prompt engineering. Either cut a leg, or put a human or a deterministic validator in the path of the action that closes the chain.

Meta’s “Agents Rule of Two” (31 October 2025)

Meta published the same shape as a design rule. Until prompt injection can be reliably detected and refused, an agent should satisfy no more than two of: [A] processes untrustworthy inputs, [B] has access to sensitive systems or private data, [C] can change state or communicate externally — all measured within a session, meaning without a reset to a fresh context window. If a task genuinely needs all three, Meta’s guidance is that the agent should not run autonomously: it needs supervision such as human-in-the-loop approval or another dependable validation mechanism.

Two useful additions over the trifecta as stated: "change state" is grouped with communication (a destructive write is as bad as a leak), and "within a session" makes context resets a legitimate architectural move — read untrusted content in one session, act on private data in another, and never in the same window.

Interactive sorting exercise: Count the legs. For each system, decide whether it has all three trifecta legs (an exfiltration chain), exactly two (survivable, with a named residual risk), or one at most. Read carefully — the legs are often hiding in a detail.

Tool: Prompt Injection Range — Count legs on live architectures and watch the chains complete: the Injection Range walks you through exfiltration attempts against agents you configure.

Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.