{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/willison-lethal-trifecta-2025/",
 "asOf": "2026-09-26",
 "id": "willison-lethal-trifecta-2025",
 "date": "2025-06-16",
 "datePrecision": "day",
 "title": "Simon Willison frames the 'lethal trifecta' of private data, untrusted content and exfiltration",
 "lane": "defense",
 "kind": "framework",
 "summary": "Simon Willison argues that an agent becomes exploitable for data theft when it combines access to private data, exposure to untrusted content, and the ability to communicate externally. He advises users to avoid combining all three, points developers to design-pattern mitigations, and argues that guardrails catching most attacks are inadequate in a security setting.",
 "whyItMatters": "The framing became a common shorthand for agent data-exfiltration risk and informed later rules such as Meta's Agents Rule of Two.",
 "actors": [
  "simon-willison"
 ],
 "topics": [
  "prompt-injection",
  "data-exfiltration"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "credentials"
 ],
 "artifacts": [],
 "sources": [
  {
   "url": "https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/",
   "publisher": "Simon Willison's Weblog",
   "title": "The lethal trifecta for AI agents: private data, untrusted content, and external communication",
   "date": "2025-06-16",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "The three components are access to private data, exposure to untrusted content, and ability to communicate externally.",
   "locator": "Main post"
  }
 ],
 "significance": 4,
 "fideQuestions": [],
 "methods": [
  "agent-data-exfiltration",
  "capability-restriction",
  "injection-classifiers"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}