Glossary
Lethal trifecta
Simon Willison’s term for an agent that combines access to private data, exposure to untrusted content and the ability to communicate externally.
Checks run on our GPUs in Switzerland. Request payloads are not stored.Security
What Lethal trifecta means
Simon Willison coined “the lethal trifecta” in June 2025 for a combination of three capabilities that makes an AI agent easy to turn against its user:
- access to private data,
- exposure to untrusted content (web pages, emails, documents, tool results), and
- the ability to communicate externally (send email, make HTTP requests, post comments).
With all three, an attacker who can get text in front of the agent can instruct it to gather private data and send it out. Because prompt injection is not reliably solved, the most robust fix is structural: remove one leg of the trifecta for a given task.
When that is not possible, checking each outbound action helps. A pre-execution guard that scores exfiltration and injection on each call can hold suspicious ones for a human. It lowers the risk; it does not remove it.
Related terms
How Lethal trifecta connects to the rest of the vocabulary.