---
title: "Lethal Trifecta Threat Model"
summary: "Classifies each tool by private-data access, untrusted-content exposure, and external communication, and blocks any execution path that has all three"
status: "best-practice"
category: "Security & Safety"
url: "https://agentic-patterns.com/patterns/lethal-trifecta-threat-model"
source: "https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/"
authors: ["Nikola Balic (@nibzard)"]
tags: ["security","prompt-injection","threat-model","data-exfiltration"]
signals: ["Agent reads private data and also processes untrusted content","Agent can send data out through network or messaging tools","Tools can be tagged with capability metadata"]
anti_signals: ["Agent has no access to private data","Agent has no way to communicate externally"]
updated_at: "2026-10-13"
---

# Lethal Trifecta Threat Model

> Classifies each tool by private-data access, untrusted-content exposure, and external communication, and blocks any execution path that has all three

## Use when

- Agent reads private data and also processes untrusted content
- Agent can send data out through network or messaging tools
- Tools can be tagged with capability metadata

## Avoid when

- Agent has no access to private data
- Agent has no way to communicate externally

## Problem

Combining three agent capabilities—
1. **Access to private data**
2. **Exposure to untrusted content**
3. **Ability to externally communicate**

—creates a straightforward path for prompt-injection attackers to steal sensitive information.  
LLMs cannot reliably distinguish "good" instructions from malicious ones once they appear in the same context window.

## Solution

Adopt a **Trifecta Threat Model**:  

- **Audit every tool** an agent can call and classify it against the three capabilities.  
- **Guarantee that at least one circle is missing** in any execution path. Options include:  
  
- Remove external network access (no exfiltration).  
  - Deny direct file/database reads (no private data).  
  - Sanitize or segregate untrusted inputs (no hostile instructions).  
- Enforce this at orchestration time, not with brittle prompt guardrails.

```python
# pseudo-policy
if tool.can_externally_communicate and
   tool.accesses_private_data and
   input_source == "untrusted":
       raise SecurityError("Lethal trifecta detected")
```

## How to use it

* Maintain a machine-readable capability matrix for every tool.
* Add a pre-execution policy check in your agent runner.
* Fail closed: if capability metadata is missing, treat the tool as high-risk.

## Trade-offs

**Pros:** Simple mental model; eliminates entire attack class.
**Cons:** Limits powerful "all-in-one" agents; requires disciplined capability tagging.

## References

- Primary source: Simon Willison, [The lethal trifecta for AI agents: private data, untrusted content, and external communication](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/) (June 16, 2025; the previously cited `/lethal-trifecta` slug was a dead 404 URL)
- Academic source: Beurer-Kellner et al., *Design Patterns for Securing LLM Agents against Prompt Injections* ([arXiv:2506.08837](https://arxiv.org/abs/2506.08837), June 2025; [doi:10.48550/arXiv.2506.08837](https://doi.org/10.48550/arXiv.2506.08837))

> **Note on terminology**: This pattern describes Simon Willison's prompt injection threat model (private data + untrusted content + external communication), distinct from the AI safety literature's "lethal trifecta" (advanced capabilities + agentic behavior + situational awareness).