Most Useful Agents Carry the Lethal Trifecta — and Why That Is Structural

Three ingredients, one exploit

The phrase lethal trifecta comes from Simon Willison, and it names the most reliable way to get data out of an AI agent. It is not a single flashy bug. It is a combination of three capabilities that, individually, all look reasonable:

1. Access to private data — your inbox, your customer records, your source, your secrets.
2. Exposure to untrusted content — web pages, emails, PDFs, tickets, anything an attacker can influence.
3. The ability to communicate externally — send an email, call an API, post to a URL, write a file that leaves the boundary.

Hold any two and you are mostly fine. Private data plus untrusted content, but no way to send anything out? An injection can confuse the agent but not steal from it. Untrusted content plus outbound comms, but no access to anything private? There is nothing worth exfiltrating. It is the presence of all three at once that is lethal: injected instructions in the untrusted content tell the agent to read the private data and ship it somewhere the attacker controls.

Why nearly every useful agent has all three

Here is the part that makes this hard to dismiss. Each leg of the trifecta is not a mistake—it is the feature. Private data access is what lets the agent act on your context instead of generic knowledge. Reading untrusted content is frequently the entire job: summarize this page, triage this ticket, answer from this document. And communicating outward is how the agent delivers value: it sends the reply, files the record, calls the service. Strip any one leg and you often strip the reason the agent exists.

That is why, when you survey real deployed agents, the trifecta is not the exception—it is close to the norm. The provocative framing that the overwhelming majority of useful agents carry all three is directionally right precisely because usefulness pulls each leg into place. (Treat any single headline percentage as an illustrative estimate from surveying common architectures, not a measured census—the structural point stands regardless of the exact number.)

You cannot always remove a leg

The textbook advice is to break the trifecta by removing one leg. Sometimes you can—an agent that only ever reads a trusted, curated corpus does not have leg two. But often removing a leg guts the product. A customer-support agent needs your records (leg one), needs to read customer messages you do not control (leg two), and needs to reply and update systems (leg three). All three are the job description.

When you cannot remove a leg, you attack the chain instead of the ingredients—and the cheapest place to break the chain is the last step: the outbound action. Injection can compromise the decision. It cannot complete the exfiltration if the send is gated.

# pip install constitutional-agent
from constitutional_agent import Constitution

constitution = Constitution.from_defaults()

async def guarded_send(outbound, ctx):
    """Gate any action that moves data across the trust boundary."""
    decision = constitution.evaluate({
        # Did this turn ingest untrusted content? (leg two present)
        "failing_tests": ctx.get("untrusted_input_present", 0),
        # Does the payload carry private / sensitive data? (leg one present)
        "proposed_spend": outbound.sensitivity_score,
        "approved_budget": ctx.get("approved_egress", 0),
        # Is the destination outside the trusted allowlist?
        "gate_override_without_amendment": outbound.is_external_untrusted,
    })

    if decision.system_state.value == "FREEZE":
        # Sensitive data + untrusted turn + external target = do not send.
        return Blocked(reason=decision.gate_results)

    return await outbound.execute()

The gate is deterministic code sitting in front of every egress action. When a turn that ingested untrusted content tries to push sensitive data to an untrusted destination, the governance gate fails, the system state goes to FREEZE, and the send never happens. The agent keeps all three capabilities—because it needs them—but the one dangerous combination is checked in code the injection cannot argue past.

You do not defeat the lethal trifecta by pretending a useful agent can live without one of its legs. You defeat it by refusing to let the three combine unsupervised at the outbound step.