# Lethal Trifecta

> The lethal trifecta is the combination of three capabilities that makes an AI agent vulnerable to data theft through prompt injection, namely access to private data, exposure to untrusted content, and the ability to communicate externally.

- Identifier: PTL-0163
- Category: Security & Adversarial Prompting
- Canonical URL: https://protologue.com/t/lethal-trifecta/
- Introduced: 2025

## Description

Any one or two are manageable, but with all three an attacker who plants instructions in content the agent reads can make it send private data out. Because no prompt-injection defense is fully reliable, the practical advice is to remove at least one of the three from any agent configuration.

## Related terms

- [Prompt Injection](https://protologue.com/t/prompt-injection/)
- [Indirect Prompt Injection](https://protologue.com/t/indirect-prompt-injection/)
- [Excessive Agency](https://protologue.com/t/excessive-agency/)
- [Dual LLM Pattern](https://protologue.com/t/dual-llm-pattern/)
- [Tool Poisoning](https://protologue.com/t/tool-poisoning/)

## Sources

- Willison (2025). The lethal trifecta for AI agents: private data, untrusted content, and external communication. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

## Cite this entry

Protologue. (2026). Lethal Trifecta. In Protologue: A Taxonomy of Prompting and LLM Techniques (v1.4.0, PTL-0163). https://protologue.com/t/lethal-trifecta/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/)