the lethal trifecta audit takes ten minutes
Private data, untrusted content, a way to phone home. Your agent only needs all three at once to ruin you, and yours probably has all three.
Simon Willison gave the pattern a name that stuck: the lethal trifecta. An agent with access to private data, exposure to untrusted content, and any channel that communicates externally is an exfiltration kit waiting for the right email. Not a hypothetical: the attacker writes instructions, your agent reads them in a webpage or a ticket or a calendar invite, and the "channel" can be as dumb as fetching a URL with the secrets in the query string.
The part that keeps biting people in 2026: nobody assembles the trifecta on purpose. Each leg arrives as its own reasonable PR. January: agent gets the vector store. April: someone wires up web search. August: it can post to Slack. Three sensible reviews, one lethal combination, zero moments where anyone approved "and now it can leak the vector store to a stranger".
So audit the combination, not the tools. Per agent, three questions: what private data can it read, what content reaches it that an outsider can author, where can bytes leave. Two legs is a risk register entry. Three is a rebuild. The diagram is the whole methodology; it fits on a sticky note and I have genuinely run it in ten minutes against a client's agent fleet, where it flagged two of seven.
Fixing it means deleting a leg, and sandboxing usually has the best cost-benefit: strip the egress and the trifecta degrades to a nuisance. The deeper habit is refusing to treat model output as trusted just because the model sounds sure, an argument Art Nikitin makes well in his groundnet write-up: confidence is a vibe, not a permission.
Your agents each pass or they don't. Ten minutes. Count legs.