Your Agent Has a Lethal Trifecta Nobody Shipped a Fix For

📖 Read the full version with charts and embedded sources on AgentConn →

Everyone shipped agents in 2026. Coding agents. Support agents. Research agents. Sales agents. The industry raced to give them tools, memory, and access to everything — then moved on to the next feature. What nobody shipped was the security primitive that makes any of it safe.

Security researcher Simon Willison named the problem over a year ago: the lethal trifecta. Three capabilities that are individually useful but collectively catastrophic when combined in a single agent. And according to a Cloud Security Alliance survey of 235 CISOs and CIOs, 92% of enterprises still lack full visibility into their AI agent identities. The trifecta is not theoretical. It is a structural vulnerability baked into nearly every production agent today.

View original post on simonwillison.net →

Willison's original post drew immediate attention on Hacker News, where it launched a broader conversation about agent trust boundaries:

View on Hacker News →

The Three Legs That Break Everything

Willison's formulation is deceptively simple. An agent becomes dangerous when it has all three of:

1. Access to private data — your databases, your documents, your internal APIs. This is the whole point of most agents. You gave them access because that is what makes them useful.
2. Exposure to untrusted content — web pages, emails, uploaded files, support tickets, calendar invitations. Anything an attacker can place text into that your agent will eventually read.
3. External communication channels — the ability to send emails, make HTTP requests, write to external databases, call third-party APIs. The pathways through which stolen data leaves your perimeter.

Any two of these are manageable. An agent that reads private data and processes untrusted content but cannot communicate externally has no exfiltration path. An agent that reads untrusted content and sends emails but has no access to sensitive data has nothing worth stealing. The danger is the combination — and the industry shipped the combination by default.

⚠️ The core problem: LLMs follow instructions wherever they appear. They cannot structurally separate your instructions from instructions embedded in content they read. A malicious instruction hidden in a web page, email, or document gets processed with the same authority as your system prompt. This is not a bug that a model update will fix — it is how transformers work.

Breaking the Trifecta: A Stripe Security Lead Explains How

At [un]prompted 2026, Andrew Bullen, AI Security Lead at Stripe, delivered a talk on breaking the trifecta without destroying agent utility. The premise: you cannot prevent prompt injection, so you must design systems where a successful injection cannot complete the trifecta circuit.

View original article on Security Boulevard →

Real Breaches, Not Theoretical Attacks

This is not an academic exercise. The lethal trifecta has been exploited in production, repeatedly.

Microsoft 365 Copilot. Researchers demonstrated that Copilot could reach organizational data across all M365 services, read untrusted email, and make external requests through image rendering. The attack bypassed Microsoft's cross-prompt injection classifier, Content Security Policy, and external link redaction. All three legs present, all three exploited.

Fortune 500 customer service agent. Cyera Labs documented a case where a customer hid a prompt injection instruction inside a support ticket. The agent — which had access to internal documentation and could send emails — dutifully followed it. It sent 47 emails overnight to external addresses, carrying internal product roadmaps, support protocols, and competitive analysis. No DLP rule fired. The agent was doing exactly what it was told, by the wrong party.

GitHub MCP Server. Attackers could access private repositories by submitting nefarious issues to public repositories. The issues contained prompt injection instructions that exfiltrated data through pull requests. The agent had access (private repos), exposure (public issues), and output (PR creation) — the full trifecta.

GitLab Duo. A chatbot was steered by rogue instructions in a public project to send private repository data to a fake security-branded domain. Same pattern: data access, untrusted input, external output.

View original post on Cyera Labs →

The pattern is always the same: the agent has legitimate access, reads attacker-controlled content, and uses its own authorized capabilities to exfiltrate. No malware. No stolen credentials. The agent is the attack surface.

From Injection to Execution: It Gets Worse

If the lethal trifecta is the strategic vulnerability, prompt injection weaponized through tool use is the tactical exploit. And in May 2026, Microsoft's Defender Security Research Team proved it can go all the way to remote code execution.

They found two vulnerabilities in Semantic Kernel, Microsoft's own open-source agent framework:

CVE-2026-26030 — The search plugin's default filter builds a Python lambda string from model-controlled input and runs it with eval(). Because the input is not sanitized, an attacker can close the quote and append arbitrary code. The researchers bypassed the AST-based blocklist by traversing Python's class hierarchy to reach a system-command function. Prompt injection becomes shell access.

CVE-2026-25592 — A two-step chain. First, an injected prompt has the agent write a malicious script inside the Azure Container Apps sandbox. Second, another prompt triggers DownloadFileAsync — which was mistakenly exposed as a callable tool — to write that script to the host's Windows Startup folder. It runs at the next user sign-in.

View original post on Microsoft Security Blog →

ℹ️ The takeaway: Prompt injection is no longer just about making an agent say something embarrassing. When agents have tools, prompt injection becomes a code execution primitive. Microsoft fixed both CVEs, but the pattern — model-controlled input reaching eval() or file-write functions — exists in countless agent frameworks that have not been audited.

The MCP Attack Surface Nobody Tested

The Model Context Protocol (MCP) was supposed to standardize how agents use tools. It succeeded — and in doing so, it standardized the attack surface too. Between January and February 2026 alone, security researchers filed over 30 CVEs targeting MCP servers, clients, and infrastructure components. The highest-severity finding was CVE-2025-6514 (CVSS 9.6) in the mcp-remote proxy package.

The NSA/CISA published a joint security advisory on MCP security design in June 2026 — a signal that the U.S. government considers agent tool-use security a national security concern. Their analysis found that malicious MCP server tool descriptions could manipulate client behavior — the tool itself becomes the injection vector.

Snyk Labs documented concrete attack chains: a prompt injection that chains through an MCP server running in Cursor to achieve command execution, and an SSRF flaw in a Markdown conversion tool where toMarkdown() blindly fetches any URL passed to it.

View original research on Snyk Labs →

The OWASP Top 10 for Agentic Applications, published December 2025 and updated through 2026, codified these risks: agent goal hijacking (ASI01), tool misuse (ASI02), identity and privilege abuse (ASI03), memory poisoning, and rogue agents. Built with over 100 experts, it is the closest thing to an industry standard for agent security — and most teams have not read it.

The Community Is Building the Missing Layer

The security gap has not gone unnoticed. On Hacker News, a Show HN for an MCP Gateway designed to block the lethal trifecta drew immediate discussion about the structural challenge: how do you enforce capability boundaries without destroying the agent's utility?

View discussion on Hacker News →

Similarly, a credential gateway project — designed to keep secrets entirely out of agent context — points to the same architectural pattern: the fix is not making agents smarter about security, it is removing the dangerous capability from their reach.

View discussion on Hacker News →

Meanwhile, Agent Vault — an open-source credential proxy and vault for agents — represents the most mature approach: keep secrets entirely outside the agent's context, so even a fully compromised agent cannot leak credentials it never saw.

View discussion on Hacker News →

All three projects converge on the same thesis: the security layer belongs in the infrastructure, not the prompt.

Why Guardrails Are Not the Answer

The security industry's instinct is to bolt on another layer: input filters, output scanners, guardrail products that promise to catch "95% of attacks." Willison's response is blunt: in web application security, 95% is a failing grade.

The fundamental challenge is that LLMs process language. Sophisticated injections will find paths that pattern matchers miss, because the attack surface is the entire space of natural language. You cannot write a regex for "every possible way to phrase 'send my data to this server.'"

⚠️ The contrarian take: Some will argue that guardrail products are "good enough" — that catching 95% of attacks puts you ahead of most organizations. The counter: every agent breach documented in 2026 happened to organizations that had security controls in place. The Fortune 500 had DLP. Microsoft had a prompt injection classifier. The trifecta does not care about your filters because the agent is operating within its authorized permissions. It is not doing anything unauthorized — it is doing the wrong thing with the right credentials.

The Fix Is Architectural, Not Another Product

If you cannot reliably prevent prompt injection — and nobody can, yet — the fix is structural. Break one leg of the trifecta for every agent.

1. Decompose Agents Into Narrower Roles

Stop building one agent that reads emails, queries databases, and posts to Slack. Build three agents with distinct, non-overlapping capabilities. The agent that processes untrusted customer emails should not have access to your internal knowledge base. The agent that queries your database should not be able to send external communications.

2. Enforce Per-Tool Least Privilege

Every agent needs its own identity with narrow, time-bound permissions. The CSA survey found that 92% of enterprises lack full visibility into their agent identities — which means most agents are running with permissions nobody has audited. Use capability tokens, not shared service accounts. Scope tools per task, not per agent.

View original research on CSA Labs →

3. Gate External Actions After Untrusted Input

Cyera's recommended architecture layers four controls: separate agent identity (not the user's full access), data flow enforcement with sensitivity tagging, isolation primitives that disable external channels once restricted data is accessed, and human authorization gates for any action that crosses a trust boundary. The agent drafts; a human approves. Not for every action — only for actions that complete the trifecta circuit.

4. Monitor at the Action Layer, Not the Prompt Layer

An OODA Loop analysis reports that 48% of cybersecurity professionals now rank agentic AI as the number-one attack vector. But only 34% of enterprises have AI-specific security controls. The gap is that most monitoring watches the prompt or the model output. It should watch the actions: what tools were called, what data was accessed, what was sent where. A hijacked agent completes its run successfully — functional testing will not catch it.

What This Means for Builders

If you are shipping agents in production — or planning to — here is your audit checklist:

1. Map the trifecta. For every agent, list: (a) what private data can it access? (b) what untrusted content can reach its context? (c) what external communication channels does it have? If the answer to all three is "yes," you have a vulnerable agent.

2. Break one leg. If the agent must read untrusted input and access private data, remove its ability to communicate externally. If it must communicate externally and read untrusted input, do not give it access to sensitive data. Design around the constraint instead of hoping your filter catches the attack.

3. Audit your MCP servers. If you are using MCP, treat every tool description as a potential injection vector. Scan for tools that call eval(), construct shell commands, or fetch arbitrary URLs. The Microsoft Semantic Kernel CVEs were in a major vendor's framework — your custom MCP servers have not been audited at all.

4. Read the OWASP Agentic Top 10. It is free. It was built by 100+ experts. It covers the threat model that your current security stack was not designed for.

5. Accept that prompt injection is unsolved. Build your architecture assuming it will happen. The question is not "will my agent be injected?" but "when it is injected, how much damage can it do?"

ℹ️ The infrastructure connection: Yesterday we wrote about the real moat being agent infrastructure. Security is the missing layer in that moat. The agent frameworks shipping today — the tools, the memory layers, the orchestrators — almost none of them include a security primitive. The team that ships a trifecta-aware agent framework, one that structurally prevents any single agent from holding all three legs, will own the next wave of enterprise adoption. The guardrail stack your harness uses today was built for model safety, not agent security — those are different problems with different solutions.

The Clock Is Ticking

The industry shipped agents at scale without shipping the security layer they require. The lethal trifecta is not new — Willison named it in June 2025 — but the attack surface grew exponentially while the defenses stayed flat. Thirty-plus MCP CVEs in two months. A government security advisory. Real data breaches in Fortune 500 companies. And 92% of enterprise security teams still cannot see what their agents have access to.

The fix is not another guardrail product. It is not a better prompt. It is architecture: decompose agents, scope permissions, gate actions, monitor behaviors. The teams that build this layer will ship agents that enterprises can actually trust. The teams that skip it will ship the next breach headline.

Your agent probably has the lethal trifecta right now. The question is whether you fix it before someone else finds it.

Originally published at AgentConn