← Back to RALAIC Academy

Vocabulary

The Lethal Trifecta, Explained Simply

In June 2025, researcher Simon Willison named a pattern that turned out to be one of the most useful mental models in AI agent security: the lethal trifecta.

The idea is that an AI agent becomes genuinely dangerous when three conditions are present at the same time, not separately, together.

First, access to private data. The agent can read something sensitive, internal documents, credentials, customer records.

Second, exposure to untrusted content. The agent processes text from somewhere it does not fully control, a webpage, an email, a document someone else wrote, that could contain hidden instructions.

Third, the ability to communicate externally. The agent can send data somewhere, an API call, an email, a file upload.

Any two of these three conditions alone are usually manageable. An agent with private data access and external communication, but no exposure to untrusted content, is just a normal integration. An agent exposed to untrusted content with no data access and no way to communicate out can be tricked, but has nothing valuable to leak and no way to leak it.

The danger appears specifically when all three combine. Untrusted content can smuggle in an instruction, the agent has the data that instruction is asking for, and it has a channel to send that data out.

Most agent architecture reviews are really asking one question: which of these three conditions can we remove, and where all three remain, what evaluates the specific action before it happens.