The lethal trifecta: break the chain that leaks your data

1. 1Meet the agent: it can read your private data, it reads untrusted content, and it can send messages out. Each is useful on its own.
2. 2Switch all three on. A web page hides an instruction, the agent obeys, and your data is on its way to a stranger.
3. 3Tap any one leg to break the chain. Danger needs all three at once.

The lethal trifecta is the combination that turns a helpful AI agent into a data leak: access to private data, exposure to untrusted content, and a way to send information out. The term comes from Simon Willison, and it names something you can see happen on the stage in about ten seconds. The agent reads a page, the page contains a hidden instruction, the agent follows it, and your secrets are exfiltrated, which just means quietly sent to someone who should not have them.

The widget makes the three legs physical. Each one is a switch. With all three live, the attack runs. Tap any single leg and the attack fails: no private data means nothing to steal, no untrusted input means no hidden instruction to obey, no exit means nowhere for the data to go. You do not have to remove all three. You have to remove one.

The reason the attack works is not a bug you can patch. A language model cannot reliably tell your instructions from instructions hidden inside the text it was asked to read. It is all one stream of tokens. Better training makes the model more suspicious, and a well-framed injection still gets through, so the durable defence sits outside the model, in what the agent is allowed to do.

Every agent product you use is one of these diagrams. An email assistant that reads incoming mail and can reply has all three legs. A browsing agent with your logged-in sessions has all three legs. The practical questions are the ones the stage asks: which leg can you cut? Keep a human approving outgoing actions, do not let the same agent both read untrusted content and send, or scope what data it can touch. Removing a leg reduces the risk. It does not eliminate it, because injection itself is unsolved.

Paste this into any HTML page, course platform, wiki or slide tool that accepts an iframe. It runs with no account, sets no cookies of its own, and links back here.

Attribution is built in. If you write about it, a link to this page is all we ask.

What exactly is the lethal trifecta?

An AI agent that has all three of: access to private data, exposure to untrusted content such as web pages or incoming email, and a way to send data out. With all three, a hidden instruction in the untrusted content can make the agent leak the private data. Remove any one and the specific exfiltration path closes.

Why can the model not just ignore instructions found in web pages?

Because there is no structural boundary between your instructions and the text it fetched. Training makes models more suspicious, and a well-framed injection still gets through. That is why the defence has to be about capabilities and permissions, not about hoping the model notices.

Can I embed this security demo in a talk or training deck?

Yes. The iframe snippet on this page works in any HTML page or slide tool that allows iframes. It runs without an account and links back to the full lesson and the prompt injection explainer.