lethal trifecta

Overview

The lethal trifecta is a security risk pattern for AI agents popularized by Simon Willison. It describes the dangerous combination of three capabilities in a single system: access to private or sensitive data, the ability to ingest untrusted content, and the ability to exfiltrate data through external actions such as email, web requests, messaging, or tool use. When all three are present, prompt injection and related attacks can turn an otherwise helpful agent into a data-leak vector.

For AI Product Managers, the concept matters because it offers a simple but powerful framework for evaluating agent risk before launch. Instead of treating agent security as abstract or purely technical, the lethal trifecta helps PMs identify whether a product design creates the conditions for a serious breach. In practice, it implies that the safest path is often to remove or tightly constrain at least one of the three legs rather than relying only on model behavior or instruction-following safeguards.

Key Developments

• 2026-04-10 — Lenny Rachitsky highlighted Simon Willison’s “lethal trifecta,” describing the major security risk created when AI agents combine private data access, untrusted content intake, and exfiltration capability.
• 2026-04-10 — The concept was reiterated in newsletter coverage emphasizing that the most reliable mitigation is to remove one of the three legs rather than assume the model can safely resist adversarial inputs.
• 2026-04-10 — The framework appeared again in a roundup context, reinforcing it as a practical mental model for evaluating agent product risk.

Relevance to AI PMs

• Use it as a feature-design checklist. Before shipping an agent, PMs can ask: Does it read sensitive internal data? Can it consume arbitrary external content? Can it send data or take actions externally? If the answer is yes to all three, the design likely needs to change.
• Guide scope and permission decisions. The framework helps PMs decide where to reduce risk: limit connector access, sandbox untrusted inputs, require human approval for outbound actions, or restrict tools that can transmit information externally.
• Improve cross-functional security reviews. The lethal trifecta gives product, engineering, security, and legal teams a shared vocabulary for discussing prompt injection, data leakage, and agent permissions in concrete terms.

Related

• Simon Willison — Widely associated with articulating and popularizing the lethal trifecta as a security model for AI agents.
• Lenny Rachitsky — Helped surface the concept to a broader product audience through newsletter coverage.
• AI agents — The concept is especially relevant to agentic systems that combine tool use, retrieval, memory, and autonomous actions.