Lethal Trifecta

Simon Willison's risk framework: an agent combining private-data access, exposure to untrusted content, and an external communication channel is structurally exploitable — remove one leg to defuse it.

Also known as: lethal trifecta, Lethal Trifecta

Part of: Agent Security

How authors use it

Oldest first (extraction date when no publication date is known).

Documents (9)

• Presentation: From Copy-Paste to Composition: Building Agents Like Real Software Jake Mannix · 2026-07-27 source ↗ Reader 🖥️
  LLM-based agents that wire raw MCP tool descriptions verbatim into an agent's context window are architecturally equivalent to unstructured 1975 BASIC — one big file, no interfaces, no encapsulation — and the fix, without rewriting MCP itself, is a lightweight 'virtual tools' layer interposed between agent and tool server that gives agent teams real interfaces, encapsulation, composition, versioning, and deterministic taint-tracking security, all stored in a shared registry alongside the evals that define what each agent is for.
• Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data Sergio De Simone · 2026-07-23 source ↗ Reader 🖥️
  GitLost proves that indirect prompt injection is a structural, unavoidable vulnerability class for agentic AI systems — because agents are inherently instruction-following and trust boundaries in agentic systems are enforced by model behavior rather than code — so organizations must treat any agent with cross-repository access and exposure to untrusted content as a live data-leak risk regardless of the content-level guardrails GitHub had in place.
• Anthropic Details How It Contains Claude Across Web, Code, and Cowork Eran Stiller · 2026-07-22 source ↗ Reader 🖥️
  Anthropic argues, and illustrates through three product-specific incident/fix pairs (Claude Code's pre-trust-decision config parsing, a red-team credential-exfiltration test, and Cowork's Files-API allowlist bypass), that agent safety must rest on deterministic environmental boundaries — sandboxed execution, default-deny networking, and function-scoped egress — because model-level controls and human approval prompts can influence but never guarantee an agent's behavior.
• Fragments: July 21 Martin Fowler · 2026-07-21 source ↗ Reader 🖥️
  This is not a single-thesis essay but a set of retreat dispatches with no forced unifying claim; the headline findings from the underlying Thoughtworks report are quoted up front but only two of the five (the executive/engineer expectation gap, and — more thinly — verification-as-bottleneck) are actually elaborated in the body, while the recurring thread that does run through the fragments that follow is a practitioner's-eye skepticism about the gap between AI hype and what people who actually work with LLMs observe — in board expectations, incident response, vibe-coding governance, and even the felt experience of reading AI-touched prose.
• Prompt Injection to Data Exfil in 3 Hops Nick Davitashvili · 2026-07-10 Reader 🖥️
  Prompt-injection-driven data exfiltration from Kubernetes-hosted AI agents cannot be stopped by probabilistic model-layer guardrails or by L3/L4 Kubernetes NetworkPolicy, and the reliable fix is deterministic, domain-aware, default-deny network egress containment that removes the lethal trifecta's channel leg — contained rather than eliminated, and paired with application-layer controls.
• GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos Sasi Levi · 2026-07-06 Reader 🖥️
  GitLost demonstrates that GitHub's Agentic Workflows can be tricked by an unauthenticated, unprivileged attacker into leaking private-repository contents through indirect prompt injection — hiding instructions in a public GitHub Issue that a cross-repo-privileged agent reads as trusted input and acts on — because the system fails to maintain a code-enforced trust boundary between untrusted user data and system-level directives, a structural weakness Noma frames as endemic to agentic AI rather than specific to this one GitHub feature.
• Running Python code in a sandbox with MicroPython and WASM Simon Willison · 2026-06-06 Reader 🖥️
  WebAssembly-embedded MicroPython is the first Python sandbox that meets all the criteria Willison thinks a trustworthy in-process sandbox must satisfy — clean PyPI install, memory/CPU limits, controlled file and network access, host-function interop, and active upstream maintenance — making it the right substrate for safely running plugin and agent-generated Python code.
• Bliki: Vibe Coding Martin Fowler · 2026-05-21 source ↗ Reader 🖥️
  Vibe coding — building software by prompting an LLM without ever looking at the generated code — is a distinct practice from agentic programming, useful only for disposable software, because forgetting the code exists produces serious risks in security, maintainability, and correctness.
• AAIF's MCP Dev Summit: Gateways, gRPC, and Observability Signal Protocol Hardening Andrew Hoblitzell · 2026-04-09 source ↗ Reader 🖥️
  MCP has crossed from experimental protocol to production enterprise infrastructure in 2026, and the central engineering challenges have shifted from basic connectivity to gateway-mediated governance, stateless transport at hyperscaler scale, security hardening, and managing the complexity of agentic systems in regulated environments.

Propositions touching this concept (4)

By publication month, oldest first (extraction month when no publication date is known).

2026-04

• explicitSimon Willison's 'lethal trifecta' (private data + untrusted content + external action) now describes most useful agents by default, not as a misconfiguration — meaning unsafe-by-default is the normal case, not the exception, for agents worth building.
  Technology Radar, Volume 34 · p6

2026-07

• explicitVibe-coded citizen-developer applications require deterministic infrastructure-level controls — separate infrastructure and restricted data access — to defuse the lethal trifecta, because relying on the developers' own security awareness is insufficient.
  Fragments: July 21 · p5
• explicitThe 'lethal trifecta' — an agent context combining access to untrusted content, an external communication channel, and access to private/internal data — creates a structural data-exfiltration risk that is common in production agents, not an edge case, because agents doing meaningful work over internal data routinely have all three capabilities at once.
  Presentation: From Copy-Paste to Composition: Building Agents Like Real Software · p13
• explicitdevelopedRemoving the exfiltration channel is the one actionable leg of the lethal trifecta, because untrusted input and sensitive-data reach cannot be removed without making the agent useless, and the channel cannot be removed entirely either — only contained deterministically.
  Prompt Injection to Data Exfil in 3 Hops · p10

Open gaps (14)

• incompleteHaving established that 'an allowlisted domain grants access to every function reachable through it,' the article stops at the single Files-API fix and does not say whether Anthropic audited its other allowlisted domains (or other products) for the same class of function-level exposure, or whether the lesson became a general policy.
  Anthropic Details How It Contains Claude Across Web, Code, and Cowork — read next: Look for a broader Anthropic security-architecture review or policy statement extending the session-token-proxy pattern beyond Cowork.
• incompleteFowler offers no mechanism for detecting when 'disposable' software is silently graduating into consequential software. The disposable/consequential boundary is treated as legible to the author, but in practice it is one of the most common failure modes in software organisations — internal scripts becoming critical infrastructure.
  Bliki: Vibe Coding — read next: Cutler on institutional overload and shadow systems; classic discussions of 'tactical' vs 'strategic' programming (Ousterhout, Philosophy of Software Design); literature on shadow IT and end-user computing.
• incompleteNo engagement with the cultural/professional question of whether vibe coding deserves the name 'coding' at all, or whether legitimising it as a coding practice (rather than, say, 'spec-driven prototyping') invites exactly the diffusion problem Fowler is trying to push back against.
  Bliki: Vibe Coding — read next: Naur on programming as theory building; the broader 'what is programming' debate that has resurfaced post-LLM.
• uninformedThe cited 75.33% law-professor preference finding for LLM answers over peer instructors is reported without the students'-side outcome (whether students who received LLM answers actually learned better or worse), the specific sample of contract-law questions used, or which models were tested — details that materially affect how far the finding generalizes beyond 'LLMs write plausible short answers professors like reading.'
  Fragments: July 21 — read next: Read the original Stanford Law study directly for full methodology and any student-learning-outcome measures, and check for replication in other legal or technical education domains.
• incompleteThe talk explicitly flags but does not resolve what happens to an agent's in-flight plan when the runtime taint-tracking layer removes tools mid-session: the speaker acknowledges the agent 'is going to think... I'm going to do this thing first... Then the tools are going to disappear. Then you're like, I'm going to do something different now. I don't know what I'm going to do,' and concedes 'it's not perfect' — but offers no mechanism for graceful replanning, partial-completion handling, or user-facing explanation when this occurs.
  Presentation: From Copy-Paste to Composition: Building Agents Like Real Software — read next: Read alongside work on agent replanning and mid-task tool-availability changes, and against extract-turing-post-5-patterns-long-running-agents on checkpoint/resume patterns for long-running agents, to see whether any existing pattern handles a shrinking tool surface mid-plan without silent agent confusion.
• uninformedThe piece frames GitLost as a freshly discovered, named vulnerability specific to GitHub's new product, but the underlying attack class — indirect prompt injection via untrusted content reaching a privileged agent with an external communication channel (the "lethal trifecta": private data access, untrusted content exposure, external channel) — is already well-documented across this corpus (GitHub's own agentic CI/CD security guidance, prior prompt-injection-to-exfiltration writeups, Willison's lethal-trifecta framing). Only the specific product surface (GitHub Agentic Workflows' cross-repo read + public-comment permission combination) is novel; the mechanism is not.
  GitLost: How We Tricked GitHub's AI Agent into Leaking Private Repos — read next: Cross-reference with extract-github-securing-agentic-cicd, extract-prompt-injection-to-data-exfil-in-3-hops, and extract-from-copy-paste-to-composition-building-agents-like-real-software's lethal-trifecta framing to see the pattern recur across vendors and delivery vectors.
• omissionThe article mentions gRPC in the title but never discusses it in the body. The Transport Working Group's SEP-1442 is about stateless HTTP, not gRPC. The title implies transport diversification that the content does not substantiate.
  AAIF's MCP Dev Summit: Gateways, gRPC, and Observability Signal Protocol Hardening — read next: Check whether gRPC transport was discussed in sessions not covered by the article; review the Transport Working Group charter.
• implicit_premiseThe article assumes that the Kubernetes analogy (interceptors as admission webhooks, gateways as ingress controllers) is the right mental model for MCP governance. This frames MCP as infrastructure middleware, which may not be the only valid framing -- it could also be framed as a capability/permission system, a marketplace, or a service mesh.
  AAIF's MCP Dev Summit: Gateways, gRPC, and Observability Signal Protocol Hardening — read next: Compare with capability-based security models (e.g., object-capability model) and service mesh patterns (Istio/Envoy) for alternative framings.
• omissionThe article does not address how MCP Apps (interactive UI in iframes) interacts with the gateway pattern -- does UI traffic flow through the gateway? Are there separate security considerations for bidirectional postMessage communication?
  AAIF's MCP Dev Summit: Gateways, gRPC, and Observability Signal Protocol Hardening — read next: Review the MCP Apps specification for security model details.
• incompleteThe article never addresses security or access control, even though Grok Bot's own described feature set — persistent agents with inbox/application access ('private data'), open interaction with websites ('untrusted content'), and inter-Bot communication over shared threads and group conversations ('communication channel') — maps almost exactly onto Simon Willison's lethal-trifecta shape. Multi-agent coordination widens the blast radius further: a compromised or misled Bot can hand off tasks to other Bots.
  SpaceXAI Launches Grok Bot for Autonomous AI Agents — read next: Look for xAI's own security/permissions documentation for Grok Bot, and compare against how Anthropic (Claude Code, Claude Cowork) and AWS AgentCore have handled agent-to-agent + inbox/tool-access governance in already-extracted pieces.
• incompleteNo explicit threat model. The article enumerates sandbox capabilities but never names the adversary: is it a confused agent, a malicious plugin author, a prompt-injection chain, or a curious user? Each implies different controls and different acceptable risk.
  Running Python code in a sandbox with MicroPython and WASM — read next: Anthropic's 'How we contain Claude' (linked in the same newsletter) provides an explicit threat-model decomposition; pair with Willison's earlier Lethal Trifecta essay for an integrated view.
• incompleteSandboxing solves blast-radius questions but not authority questions. The Meta example (linked in the same issue) shows that the catastrophic failure is granting agents excessive *sanctioned* power — which a perfectly secure sandbox does nothing to prevent. The article never connects these.
  Running Python code in a sandbox with MicroPython and WASM — read next: Read the Meta item against Anthropic containment essay against this piece syntopically; ask 'what authority does the code inside the sandbox have, and who decided?'
• incompletePyodide is dismissed for server-side use on the basis of a 2024 statement; no engagement with running Pyodide via Node embeddings, with PyPy-WASM, RustPython, Starlark, or restricted-Python variants. The 'survey of alternatives' is thin given the strength of the resulting claim.
  Running Python code in a sandbox with MicroPython and WASM — read next: Recent Pyodide release notes, RustPython status, the Bytecode Alliance's component-model work for cross-language sandboxing.
• incompleteNo discussion of side channels or supply-chain risk in the distributed 362KB WASM blob. A prebuilt opaque artifact in a PyPI package is itself a trust delegation, and reproducible builds are not addressed.
  Running Python code in a sandbox with MicroPython and WASM — read next: WebAssembly component-model security analyses; reproducible-build practices for prebuilt native artifacts on PyPI.