How the 'Lethal Trifecta' Turns AI Agents Into Data Exfiltration Tools

Security researchers have identified a dangerous combination of three AI agent capabilities — access to private data, exposure to untrusted content, and external communication channels — that together create a critical vulnerability dubbed the 'lethal trifecta,' a term popularized by Simon Willison. When all three are present in a single agent, attackers can embed hidden instructions inside content the agent reads, such as emails, web pages, or documents, causing it to act on malicious commands without the user's knowledge. Unlike traditional software, large language model-based agents cannot reliably distinguish between data and instructions, making them susceptible to prompt injection attacks that can be concealed in HTML comments, image alt text, PDF metadata, or invisible text. A real-world scenario illustrates the risk: a support agent with access to customer records, incoming emails, and outbound webhooks could be tricked via a hidden email instruction into exfiltrating sensitive customer data to an attacker's server. Experts stress this is a structural property of how AI agents function, not a flaw in any single model, and that removing even one of the three capabilities breaks the attack chain entirely.