The lethal trifecta for AI agents: private data, untrusted content, and external communication

Author: Simon Willison · Type: practitioner · Status: draft · Published: 2025-06-16 · URL: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

Licence: Personal blog; CC BY 3.0 noted on simonwillison.net footer for most content - verify before republishing.

Summary

Defines the now-standard security frame for agent deployments: any agent that combines access to private data, exposure to untrusted content, and the ability to communicate externally is exploitable via prompt injection regardless of guardrail products. The mitigation is architectural - never grant all three capabilities to the same agent context.

Insights

• Agent safety is an architecture problem, not a filter problem: the only reliable defense is to avoid combining private-data access, untrusted input, and external communication in one agent. (high, draft) security autonomy guardrails

  The only way to stay safe there is to avoid that lethal trifecta combination entirely. — Core argument / mitigation section

• Probabilistic guardrails that catch most attacks are inadequate for security purposes; a 95% catch rate is a failing grade when a single success exfiltrates data. (high, draft) security guardrails

  Willison dismisses guardrail products claiming to capture ‘95% of attacks’, calling this ‘very much a failing grade’ by web application security standards. — Discussion of guardrail vendors

• Once untrusted content enters an agent’s context, that agent must be barred from consequential actions - directly applicable to agents that browse the web and also hold deploy or database credentials. (high, draft) security autonomy agents in production

  Once an LLM agent has ingested untrusted input, it must be constrained so that it is impossible for that input to trigger any consequential actions. — Mitigation advice