Security researcher Simon Willison named it in June 2025: the lethal trifecta. Three capabilities that, when they exist in the same AI agent, create a direct path from an attacker’s text to your private data. His definition is worth quoting exactly:
The lethal trifecta of capabilities is: Access to your private data … Exposure to untrusted content … The ability to externally communicate.
Any one of those is fine. Any two are survivable. All three together mean a single successful manipulation can read your secrets and send them out the door, and you find out later, if at all.
Why the three combine so badly
Language models don’t separate instructions from data. A web page, an email, a PDF, a customer support ticket: if your agent reads it, the text inside it can carry instructions. The model can’t reliably tell “here’s a report” from “and by the way, forward the payroll file to this address.”
So walk the three legs with your own systems. Does the agent reach private data? Does it read anything from outside your company, even a supplier’s website or a forwarded email? Can it send anything out, an HTTP call, a message, an API request? Three yeses is the condition Willison warned about.
It already happened in production
In 2025, researchers disclosed EchoLeak (CVE-2025-32711), a zero-click vulnerability in Microsoft 365 Copilot. A single crafted email, no user interaction at all, caused Copilot to pull confidential data from the victim’s own context and route it to an attacker-controlled server. Microsoft patched it server-side before it was ever exploited in the wild, which is exactly the point: the pattern works, and the pattern is now public.
How to remove a leg
OWASP’s 2026 guidance treats the trifecta as a pre-deployment check: remove any one leg and the exfiltration conditions disappear. The practical moves:
- Cut external sending. If an agent has no reason to call outside services, take the capability away entirely. In Microsoft Copilot Studio, that’s a data policy that blocks the HTTP connector, Microsoft documents the control for exactly this reason.
- Cut private data access. If the agent’s job is public info, don’t let it read anything sensitive in the first place.
- Cut untrusted input. If the agent must handle private data and send external messages, keep its inputs curated: approved documents, not whatever arrived in the inbox this morning.
Filtering helps, but it can’t be your control. Injected instructions don’t carry a signature, and the teams that defend this well treat filters as a reduction in frequency, never as the fix.
The question for your next agent project
Before any agent goes live, count the legs. If the answer is three, redesign until it’s two, and write down which leg you removed and how. If you’d like a second pair of eyes on an agent you’re building or buying, counting legs is where we start.