Topic 6

The lethal trifecta

Simon Willison's "The lethal trifecta for AI agents" (2025) names a combination of capabilities that's dangerous whatever else you do:

1. Access to private data: customer records, email, files.
2. Exposure to untrusted content: anything an attacker could have written, such as web pages, inbound emails or tickets.
3. The ability to communicate externally: sending email, calling an API, even loading a URL.

With all three in one agent, an attacker can put instructions in the untrusted content that tell the agent to read the private data and send it to them.

Try the combinations. Note that browse_web gives two capabilities at once: it reads untrusted pages, and loading a URL is itself a way to send data out.

Willison's advice is to avoid the combination, rather than rely on guardrails to catch the attack. He points out that products claiming to block such attacks often advertise catching 95% of them, and that in web application security, 95% is very much a failing grade. Since there's no fully reliable prevention, the safe design is one where no single agent has all three. Options:

• remove one leg: no external communication from an agent that reads private data and untrusted content;
• constrain the leg: outbound messages only to fixed, known recipients (the policy from two pages back);
• split the work: one agent reads untrusted content and returns plain, structured results to another that has the private data, with code in between.