What it is
The main class of agent vulnerabilities is prompt injection: an LLM executes instructions from any text that lands in its context, without telling a "user command" apart from "an attacker's command hidden in the data". Simon Willison coined the "lethal trifecta" - the combination of three capabilities that makes the attack trivial.
The three components of the trifecta:
- Access to private data (the agent reads mail, documents, databases).
- Exposure to untrusted content (emails, other people's docs, web pages).
- The ability to send data out (call an API, render an image by URL, generate a link).
Once all three come together, an attacker can use an injection in the data to exfiltrate private data.
Where it came from
- 16 June 2025 - Simon Willison publishes "The Lethal Trifecta for AI Agents".
- Summer 2025 - a series of real exploits: Microsoft 365 Copilot, the official GitHub MCP server, GitLab Duo and others.
- Meta releases the "Agents Rule of Two" framework, inspired by the trifecta.
Why it's critical right now
- MCP encourages mixing tools from different sources - which means accidentally assembling all three conditions of the trifecta.
- The research converges on this: prompt injection is an unsolved problem; filters and blocklists aren't reliable enough.
- The more autonomous the agent (computer use, background tasks), the higher the stakes of a mistake.
How to defend yourself
- Break the trifecta: never combine private data + untrusted content + an outbound channel at the same time.
- Read-only wherever writes aren't needed; irreversible actions only with human confirmation.
- Isolate the agent (sandbox), restrict sub-agents' tools, log the actions.
What to watch out for
- "We added an injection filter" does not count as reliable protection; rely on a permissions architecture, not on a filter.
- The danger isn't only in code but in data: a malicious instruction can arrive in an issue, an email or on a web page.
- The MCP server supply chain is a separate vector: install only what you've vetted.