The Lethal Trifecta

An AI agent becomes dangerous when it combines three capabilities at once: access to private data, exposure to untrusted content, and the ability to communicate externally. Any one or two of these is manageable. All three together let an attacker hide instructions in something the agent reads — an email, a web page, a file — and have the agent exfiltrate your data on command. The agent acts with your credentials, so the log will say you did it.

This is not a bug. It is an architectural property of systems that follow instructions wherever they appear in their context. The fix is to never let an agent hold all three at once.

Discussion prompts

• Which of your AI agents hold all three trifecta capabilities — and was that decided on purpose?
• Some researchers propose capping agents at two of the three properties. What would that cost your team?
• AI-04 describes what attackers exploit. How does the trifecta change how fast or cheap that exploitation gets?