Dev, web & IT
Design, code, host and ship sites and internal tools, with an AI editor doing most of the typing.
Independent reviews. IonBin has no partnerships with the tools on this page and was not paid for these listings. Our evaluations are our own, based on public documentation and our research. Product names are trademarks of their owners and are used for identification only. How disclosure works.
Concept
Stack 08 Stack 06
The lethal trifecta (agent security)
Verified Oct 17, 2026 Review by Apr 15, 2027 1 source
Short answer
The lethal trifecta is Simon Willison's name for a dangerous agent setup: access to private data, exposure to untrusted content, and a way to send data out. With all three, a prompt injection hidden in an email or web page can make the agent leak your data. The fix is to remove at least one leg from every workflow.
What it is
Prompt injection means instructions hidden in content the agent reads. On its own it is a nuisance. Combined with private data and an outbound channel, it becomes a data-leak path.
How it works
The three legs:
- Private data: your inbox, CRM, files or database.
- Untrusted content: emails from strangers, web pages, support tickets, uploaded documents.
- External communication: sending email, posting, opening links, calling webhooks or creating public pull requests.
When one agent session has all three, an attacker only needs to get text in front of it. Willison’s example is a GitHub MCP server that reads public issues an attacker could file, can see private repositories, and can open pull requests. Connectors make this easy to do by accident, because each MCP server you add may supply a different leg.
Benefits
- A simple audit. List each agent workflow and mark which legs it has.
- Clear fixes. Remove outbound actions, split reading from sending into separate steps, or require human approval before anything leaves.
Limits and risks
- Filters are not enough. Willison argues that guardrail products claiming to block “95% of attacks” fall short, because in security 95% is a failing grade. Design the risk out instead.
- Sandboxes don’t solve it (IonBin’s view). A sandbox limits damage to your systems; it doesn’t stop an agent sending out data it can already read.
- Approvals fatigue. If every step needs a click, people stop reading. Gate only the outbound step.
Checked specs
Snapshot from official sources on Oct 17, 2026.
| The three legs | Access to private data, exposure to untrusted content, and the ability to communicate externally [1] |
| Guardrail products | Willison is deeply suspicious of tools claiming to catch "95% of attacks": in web application security, 95% is a failing grade [1] |
| His advice for people mixing tools | Avoid the combination entirely [1] |
Best-fit stacks
Ops & admin automation
Hand repeat admin (receipts, logs, notices, handoffs) to workflows your agent can trigger.
Agent compatibility
Levels come from each tool's recorded, sourced compatibility. How the levels work.
Related entries
Sources
- The lethal trifecta for AI agents: private data, untrusted content, and external communication · Simon Willison, 2025-06-16Practitioner view accessed Oct 17, 2026
Practitioner views are restated in our words and labeled as views, not measured results. Product facts come from official sources dated above.
Suggest an edit
IonBin's wiki isn't user-edited. Corrections go to our Directory Curator, who checks them against primary sources before anything changes. Spot something wrong or out of date on “The lethal trifecta (agent security)”? Email us with a link to a primary source.
Suggest an edit by email or write to [email protected]