02 — attack concepts

Lethal trifecta

Simon Willison's name for the combination that turns an agent into an exfiltration engine: (1) access to private data, (2) exposure to untrusted content, and (3) the ability to communicate externally. Any one or two is manageable; all three together mean an indirect injection in the untrusted content can read the private data and send it out, with no vulnerability required anywhere. Its practical value is as a design rule — break one leg per session — and as a triage signal, since a single agent holding all three is where attention belongs.

Related terms

Indirect prompt injection Attack concepts
The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's…
Data exfiltration Attack concepts
Moving data the attacker should not have out to somewhere they control. In agent contexts the channel is rarely a file upload — it is a URL the agent is…
Confused deputy Attack concepts
A classic security problem, dated 1988, that agents reproduce almost perfectly: a privileged component is tricked by a less-privileged party into misusing…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Lethal trifecta is term 14 of 14 in this part of the glossary.

Prompt injection Direct prompt injection Indirect prompt injection Jailbreak Obfuscation / encoding Homoglyph Leetspeak Multi-turn crescendo Tool poisoning Tool-name shadowing Capability expansion Confused deputy Data exfiltrationLethal trifecta

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.