{
  "id": "lethal-trifecta",
  "code": "PTL-0163",
  "term": "Lethal Trifecta",
  "aliases": [],
  "category": "security",
  "definition": "The lethal trifecta is the combination of three capabilities that makes an AI agent vulnerable to data theft through prompt injection, namely access to private data, exposure to untrusted content, and the ability to communicate externally.",
  "description": "Any one or two are manageable, but with all three an attacker who plants instructions in content the agent reads can make it send private data out. Because no prompt-injection defense is fully reliable, the practical advice is to remove at least one of the three from any agent configuration.",
  "example": null,
  "broader": [],
  "narrower": [],
  "related": [
    "prompt-injection",
    "indirect-prompt-injection",
    "excessive-agency",
    "dual-llm-pattern",
    "tool-poisoning"
  ],
  "introduced": 2025,
  "added": "2026-10-10",
  "sources": [
    {
      "title": "The lethal trifecta for AI agents: private data, untrusted content, and external communication",
      "authors": "Willison",
      "year": 2025,
      "url": "https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/"
    }
  ],
  "url": "https://protologue.com/t/lethal-trifecta/",
  "citation": "Protologue. (2026). Lethal Trifecta. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0163). https://protologue.com/t/lethal-trifecta/"
}