Lethal Trifecta
How it works
An attack exploiting the lethal trifecta proceeds as follows: (1) the attacker plants malicious instructions in untrusted content the agent will process (e.g. a web page, email, repository issue, or document); (2) the agent, having access to private data, executes the injected instructions as if they were its own commands and reads confidential information; (3) the agent uses its ability to communicate externally (e.g. a tool call, network request, rendering an image from a URL, or creating a pull request) to send the stolen data to the attacker. The key point is that an LLM does not distinguish trusted user commands from untrusted content in the same context โ the same weakness underlying prompt injection. Willison's core recommendation: do not combine all three capabilities in one system; removing even one leg of the trifecta breaks the exfiltration path.
Problem solved
It provides a practical, memorable threat model that lets designers and users of AI agents quickly recognize when a system is vulnerable to data theft via prompt injection โ instead of reasoning about prompt injection abstractly, one just checks whether all three trifecta capabilities co-occur.
Components
The system's ability to read confidential data: private repositories, emails, documents, databases, secrets, personal data. Without it, there is nothing to steal.
The model processing text or images controlled by third parties: web pages, emails, repository issues, documents, comments. This is the carrier of hidden prompt-injection instructions.
The ability to send data outward: tool calls, network requests, rendering images with URL parameters, creating pull requests, sending messages. It completes the data-leak path.
Implementation
An agent rendering Markdown images from an attacker-controlled URL sends stolen data as URL query parameters. Used in GitLab Duo and EchoLeak, among others.
An MCP server with access to private repos, reading public issues (untrusted content), and creating pull requests (exfiltration channel) implements the whole trifecta in one tool โ as in the GitHub MCP exploit.
The attacker hides instructions in documents, PDFs or pages (white text, metadata, alternative syntax) that a human overlooks but the model executes.
Evolution
Simon Willison and others independently name prompt injection โ mixing trusted and untrusted content in the same LLM context. This is the foundation the lethal trifecta builds on.
On 16 June 2025 Willison publishes the article defining the lethal trifecta as the combination of access to private data, exposure to untrusted content, and the ability to communicate externally.
A documented data-exfiltration attack on Microsoft 365 Copilot, a real-world instance of the lethal trifecta in a commercial product. Similar flaws were found in the GitHub MCP Server and GitLab Duo.
Execution paradigm
This is not a model compute paradigm but a conditional threat pattern โ the vulnerability activates when untrusted content contains malicious instructions.