The lethal trifecta is a term coined by Simon Willison in June 2025 for three capabilities that make an AI agent exploitable when it holds all of them at once: it can read private data, it processes content an attacker can control, and it can send information out. Any one of these is routine. Together they let a hidden instruction in an email, web page or issue tell the agent to fetch sensitive data and send it to the attacker.
The concept is useful for governance because each leg tends to be reviewed separately and rated low. Real cases such as EchoLeak in Microsoft 365 Copilot and the GitHub MCP private-repository leak both followed this pattern, and neither depended on a single severe code flaw.
The simplest test for any agent is to list which of the three it has. If it has all three, remove one, usually by narrowing data access or requiring approval for anything leaving the organisation, before relying on prompt-injection filters to hold.