From IonBin New tools and workflows every week. See what’s new
Check your agent setups for the lethal trifecta
Dev, web & IT · Ops & admin automation · checked 2026-10-17
List each agent workflow with its connectors, ask Claude to mark which have private data, untrusted input and an outbound channel, and fix any with all three. Keep the audit in a GitHub repository so every change is reviewed in a pull request.
Independent review. IonBin has no partnership with any tool on this page and was not paid for this page. Our evaluation is our own, based on public documentation and our research. Product names are trademarks of their owners and are used for identification only. How disclosure works.
Confirmed means the vendor documents it (linked). It doesn't mean IonBin has tested it. AI-platform and human steps need no source.
Human approval
You change every permission yourself.
Watch out for
An AI audit is a checklist, not a security review.
Starter prompt
For each workflow below, mark yes or no for: reads private data, reads untrusted content, can send data out. For any with three yeses, suggest the smallest change that removes one.
Written for this workflow. Paste it into your AI platform and adjust it to your situation.
No platform-specific connection: the steps run in the tools themselves (browser, upload or built-in).
ChatGPT
Confirmed
No platform-specific connection: the steps run in the tools themselves (browser, upload or built-in).
Gemini
Confirmed
No platform-specific connection: the steps run in the tools themselves (browser, upload or built-in).
Perplexity
Confirmed
No platform-specific connection: the steps run in the tools themselves (browser, upload or built-in).
Computed from the MCP and API steps only: "Confirmed" needs the tool's docs to name the platform and the platform to support the connection. Browser, upload and human steps work from any platform.
What we checked (2026-10-17)
Simon Willison’s lethal trifecta (June 16, 2025) is the combination of access to private data, exposure to untrusted content and the ability to communicate externally. With all three in one agent session, text an attacker controls can lead the agent to send your data out. He is deeply suspicious of guardrail products that claim to catch “95% of attacks”, because in security 95% is a failing grade, and says that for people mixing tools together the only safe option is to avoid the combination entirely. See the lethal trifecta.
Set it up
Write a table of every agent workflow: what it reads, where untrusted text can enter, and what it can send, post or open.
Ask Claude to mark the three legs for each row and suggest which leg to remove.
Make the changes yourself: narrow a connector, split reading from sending, or add an approval step before anything leaves.
Commit the table to a GitHub repository and review changes in pull requests.
An AI-assisted audit is a checklist, not a security review.
