The lethal trifecta.

Your AI assistant reads your email, browses the web, and can send messages. Congratulations — you've built a machine that can leak your secrets. No exploit needed.

The one idea

The "lethal trifecta": give an AI agent private data + exposure to untrusted content + an outbound channel, and data exfiltration becomes possible by design — injected instructions read your secrets and send them out. Remove one leg, or assume breach.

Here's a security pattern every AI agent builder needs memorized: the lethal trifecta. Three capabilities, each fairly harmless alone. One: access to private data. Two: exposure to untrusted content. Three: an outbound channel. Give one agent all three, and you've built an exfiltration machine — by design. Why lethal? Recall that a model can't reliably tell data from instructions — that's prompt injection. So an attacker hides an instruction inside the untrusted content: a document, a web page, an email. The agent reads it, obeys it, reaches into your private data, and sends it out the channel. Theft complete, no zero-day. Make each leg concrete. Private data is internal files, user records, secrets. Untrusted content is anything from outside you don't control — a web page, an email, a shared document, a tool's output.

How it works — the demo

An agent reading a poisoned document (untrusted content) that instructs it to grab private data and email it out — all three legs present, exfiltration completes.

The outbound channel is any way to send data out: email, an API call, a web request. Each is reasonable alone; together they're the loop. So the defense isn't a clever filter — it's architectural. Remove at least one leg. Don't let an agent that reads untrusted content also touch private data. Or cut its outbound channel. Or don't give it the private data at all. Break any single leg and the loop can't close. A structural fix, far stronger than trying to detect every attack. But what if the agent genuinely needs all three? Then you assume breach. Assume injection will happen, and constrain hard: human confirmation on outbound actions, least-privilege on the private data, sandbox the agent. The mindset is the shift — don't hope to block every attack; pre-limit the blast radius for when one lands. The trap: reviewing each capability in isolation.

The trap to avoid

Thinking each capability is safe on its own — the danger is the combination; any agent with all three legs is exfiltration-ready, no exotic exploit required.

Why it matters — and what’s next

The trifecta exploits the model following injected instructions. but what about attacking its safety training directly — jailbreaks?

Private data — fine. Reads the web — fine. Sends email — fine. Each passes alone, and the danger that lives only in their combination is never evaluated. Any agent with all three legs is exfiltration-ready. Audit for the trifecta, not the features. So the lethal trifecta: private data, untrusted content, and an outbound channel add up to exfiltration by design. Remove a leg, or assume breach and constrain. Audit the combination, not the features. This attack rides the model obeying injected instructions. But what about attacking its safety training directly? Next: jailbreaks.

This is one short episode in AI: Zero → Frontier, a step-by-step climb through how AI actually works. Each episode builds only on the ones before it.