5K

Lethal Trifecta Threat Model

Classifies each tool by private-data access, untrusted-content exposure, and external communication, and blocks any execution path that has all three

best practice Updated 2026-10-13 By Nikola Balic (@nibzard) Based on Simon Willison
View .md Edit on GitHub
Add to Pack
or

Saved locally in this browser for now.

Cite This Pattern
APA 
Nikola Balic (@nibzard) (2026). Lethal Trifecta Threat Model. In *Awesome Agentic Patterns*. Retrieved October 14, 2026, from https://agentic-patterns.com/patterns/lethal-trifecta-threat-model
BibTeX 
@misc{agentic_patterns_lethal-trifecta-threat-model,
  title = {Lethal Trifecta Threat Model},
  author = {Nikola Balic (@nibzard)},
  year = {2026},
  howpublished = {\url{https://agentic-patterns.com/patterns/lethal-trifecta-threat-model}},
  note = {Awesome Agentic Patterns}
}

Use when

  • Agent reads private data and also processes untrusted content
  • Agent can send data out through network or messaging tools
  • Tools can be tagged with capability metadata

Avoid when

  • Agent has no access to private data
  • Agent has no way to communicate externally

Problem

Combining three agent capabilities—

  1. Access to private data
  2. Exposure to untrusted content
  3. Ability to externally communicate

—creates a straightforward path for prompt-injection attackers to steal sensitive information.
LLMs cannot reliably distinguish "good" instructions from malicious ones once they appear in the same context window.

Solution

Adopt a Trifecta Threat Model:

  • Audit every tool an agent can call and classify it against the three capabilities.

  • Guarantee that at least one circle is missing in any execution path. Options include:

  • Remove external network access (no exfiltration).

    • Deny direct file/database reads (no private data).
    • Sanitize or segregate untrusted inputs (no hostile instructions).

  • Enforce this at orchestration time, not with brittle prompt guardrails.

# pseudo-policy
if tool.can_externally_communicate and
   tool.accesses_private_data and
   input_source == "untrusted":
       raise SecurityError("Lethal trifecta detected")

How to use it

  • Maintain a machine-readable capability matrix for every tool.
  • Add a pre-execution policy check in your agent runner.
  • Fail closed: if capability metadata is missing, treat the tool as high-risk.

Trade-offs

Pros: Simple mental model; eliminates entire attack class. Cons: Limits powerful "all-in-one" agents; requires disciplined capability tagging.

References

Note on terminology: This pattern describes Simon Willison's prompt injection threat model (private data + untrusted content + external communication), distinct from the AI safety literature's "lethal trifecta" (advanced capabilities + agentic behavior + situational awareness).