The lethal trifecta
Your helpful agent reads a web page, and quietly emails your private data to a stranger. How?
The idea inside
Danger spikes when an agent has all three: private data, untrusted content, and a way out.
After this lesson
You can explain the lethal trifecta (private data + untrusted content + external comms) and how to defuse it.
Where it leads
Security is one production concern; trust with users is another.
Inside this lesson
That's the real lesson stage, paused. Claim your pass to operate it.
See how AI actually works, end to end.
This lesson is one stop on the full arc. Unlock all of it, and keep it for life.
What you get
- The 34-lesson main path, a finishable route from a word to agents
- Goal tracks for using AI at work and building AI features
- Boss labs that make you apply a whole act, not just recognize it
- Spaced recall that brings each idea back before you forget
- Course memory: every term defined, with links to where it first appears
- A shareable capability card when you finish the main path
- Lifetime access on every device, every future lesson included
Not videos to watch. You predict, operate the machine, then prove it. That is why it stays.
99 interactive lessons and challenges. No videos, no code.
Free launch pass: lifetime access, no card needed
New here? The first lessons are free to try. Start with lesson 0.1
What this lesson shows
Danger spikes when an agent has all three: private data, untrusted content, and a way out.
The question it opens with
Your helpful agent reads a web page, and quietly emails your private data to a stranger. How?
The walkthrough, in the lesson's own words
- Three live legs, one running attack. Tap any ONE leg to switch it off.
- One helpful agent, three capabilities. Each is useful on its own.
- Now all three are live. Watch the untrusted page take over.
- Danger needs all three at once. Remove any leg to defuse it.
- The page hid an instruction, the agent obeyed, and your data is on its way out. Tap a leg to break the chain.
- The model can't reliably tell your instructions from instructions hidden in what it reads. Any single capability is fine on its own; only all three at once let an attacker read your secrets and send them out.
- Injection itself is unsolved, removing a leg reduces the risk, it doesn't eliminate it.
- You're about to give an agent access to your private email so it can read incoming messages and reply on your behalf. Why is that combination dangerous, and how would you reduce the risk?
- That setup wires up all three legs of the lethal trifecta: private data, untrusted incoming content, and a way to send out. A message could carry a hidden instruction (prompt injection) that makes the agent leak your data. Break a leg: keep a human approving any outgoing reply, or don't let the same agent both read untrusted mail and send. Removing a leg reduces the risk; it does not eliminate it.
- Exfiltrated = quietly sent out to someone who shouldn't have it.
Key takeaway
You can spot the lethal trifecta and break it, drop private data, untrusted input, or the exit.
What you can do after this lesson
You can explain the lethal trifecta (private data + untrusted content + external comms) and how to defuse it.
Check yourself: The 'lethal trifecta' is dangerous when an agent has…
- Private data + untrusted content + a way to send data out(correct)
- A big context window
- Too many tools installed
- A slow model
All three together are the danger: access to private data, exposure to untrusted content that can hijack it, and a channel to send data out. Remove any one leg and the attack breaks.
Prefer reading first? This lesson has a companion explainer: Prompt injection
Where it leads: Security is one production concern; trust with users is another.
This is the written summary. The lesson itself is interactive: you predict, drag and operate the mechanism above, and the reveal answers you.