The Lethal Trifecta: A Five-Minute First Pass on AI Agent Security
Apply the lethal trifecta to a coding assistant, find hidden outbound routes, and turn an initial triage into a specific control and a test.
BY AISECURITYINTERVIEWS EDITORIAL · EDITORIAL TEAM · UPDATED NOVEMBER 7, 2026 · 4 MIN READ
PRACTICE THIS:Study the mechanism and its limits ·Practice agent security decisions
A coding assistant is asked to triage public bug reports. It can also read private repositories and publish public pull requests. Before evaluating its model, ask a simpler question: why does this task have all three capabilities?
This is a hypothetical design review. The five-minute pass below aims to produce one actionable finding and a test. It is not enough time to establish that an agent is secure.
Start with the user's actual task
Assume the user wants a summary of open issues in a public repository, not a patch or a public response. An outsider can create an issue. The assistant's workspace also contains a private repository, and its credentials permit public writes.
Simon Willison's lethal trifecta gives the inventory three labels: private data, untrusted content and external communication. Here, the issue supplies untrusted input, the private checkout supplies sensitive data, and publishing supplies a route to people who should not receive that data.
The private checkout matters even if the GitHub token is narrowed. A filesystem tool may still read it. Changing one credential does not remove every source of authority.
Tools this agent holds
All three legs present: exfiltration is possible
Trace whether untrusted input can cause private data to reach an unauthorized destination. Remove unnecessary capabilities or enforce the permitted data flow outside the model.
Spend the five minutes on a specific decision
| Time | Review step | Result to write down |
|---|---|---|
| Minute 1 | Confirm the requested output | A private summary for the authenticated user |
| Minute 2 | List inputs and resources | Public issues, private checkout, model context, stored memory |
| Minute 3 | Trace outbound routes | Public writes, arbitrary fetches, generated images, shared files |
| Minute 4 | Remove unnecessary authority | No private checkout, no public-write credential, bounded fetching |
| Minute 5 | Specify verification and remaining risk | Test alternate routes; review summary accuracy separately |
For this task, create a workspace containing only the public project material. Give the worker a read-only integration restricted to the intended resource and no ambient credentials. The host can fetch the selected public issues; the worker does not need to choose arbitrary destinations. Return the summary to the authenticated user through a renderer that does not automatically load arbitrary remote resources.
This preserves the requested feature while removing access and actions it did not need. It still needs ordinary application authorization, resource limits and a review of how the summary is presented.
Change the task and reconsider the control
Now the user asks the assistant to investigate whether a bug also affects a private commercial edition. Private code access may be justified. Keep the output private and constrain the selected repository and files. If a public patch is later required, make publication a separate authorized action that shows the exact diff and destination for review.
Do not claim that two agents automatically solve the problem. An analysis worker can put sensitive information into a summary that a publishing worker then posts. The handoff needs a disclosure policy, and the publisher must not treat a model-written summary as proof that the data is public.
Likewise, a typed result is useful only within a defined contract. A field called summary can still contain confidential text or instructions. Validate the allowed values and keep the decision to disclose outside the model. The agent design lesson shows where those checks belong.
Try these three variations
Before reading the right-hand column, identify the missing boundary.
| Proposed fix | What still needs checking |
|---|---|
| Remove public pull-request creation | Arbitrary web requests, images and shared writes may still disclose data |
| Allow publishing only to an approved hosting domain | The domain may contain public or attacker-readable repositories; check the exact resource and content |
| Use a separate agent to review the draft | It may see the same hostile material, and its judgment remains probabilistic; independent service policy still applies |
For an email assistant, the equivalent mistake is to approve every existing contact. A thread can contain an outsider, or the reply may include a file that an otherwise legitimate recipient should not receive. Destination familiarity and permission to disclose are different checks.
Verify the claim you intend to make
Use synthetic content in a system you own or are authorized to test. Check that the public-summary worker cannot read the private fixture, that it has no public-write credential, and that model-controlled URLs cannot create unrestricted outbound requests. Include background jobs, stored credentials and any other agents that can receive its output.
For approval, change the recipient, repository or artifact after review and verify that execution requires a new decision. For a permission downgrade, check old credentials and queued work instead of inspecting only the newest token. The trifecta lesson explains that distinction.
Record the identity, operation, policy result and source references needed for investigation. Restrict access and retention; a full copy of every private file in logs is another exposure to manage.
Your finding should be concrete: which unnecessary capability was present, how you removed it, which test verified the restriction and what remains. The two-minute interview exercise helps you practice stating that reasoning aloud.
Interview questions and lessons that go deeper on this post:
FAQ
It combines access to private data, exposure to untrusted content and an outbound communication route. Simon Willison named it in June 2025. Use it to trace possible disclosures, including those through browsers, shared files and other agents.