# Lethal Trifecta

> An agent combining private-data access, exposure to untrusted content, and external communication is practically undefendable against prompt injection.

- Category: Evaluation & Safety
- Stage: Rising
- Also called: Trifecta of risk
- Canonical: https://www.joelcsaji.com/ai-dictionary/lethal-trifecta

## Plain English

If your agent can read your secrets, see attacker-controlled text, and talk to the outside world, assume a crafted message can leak the secrets.

## Example

A mail assistant that reads your inbox, parses incoming email, and can send calendar invites is the textbook trifecta - one malicious email away from leaking your contacts.

## Why it matters

It is a fast design-level security test: break any one leg - sandbox the network, isolate untrusted content, restrict egress - and the exfiltration chain fails.

## Related

- [Prompt Injection](https://www.joelcsaji.com/ai-dictionary/prompt-injection)
- [Sandbox](https://www.joelcsaji.com/ai-dictionary/sandbox)
- [Human-in-the-Loop](https://www.joelcsaji.com/ai-dictionary/human-in-the-loop)

## Sources

- [Simon Willison: The Lethal Trifecta](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/)