The Lethal Trifecta: Architectural Anti-Pattern Behind Most AI Agent Vulnerabilities
Security researcher Simon Willison has identified the Lethal Trifecta as a core anti-pattern in AI agent design. The combination of private data, untrusted content, and any external output channel creates systems that are vulnerable by construction. Prompt injection attacks succeed because large language models process instructions and data as flat text without structural boundaries. Mitigation requires breaking the triad through architectural separation rather than relying on probabilistic filters or markup. The article distinguishes between user-controlled agents and autonomous cloud agents, recommending task isolation, least-privilege connectors, and verified data-flow policies. Approaches such as CaMeL and formal verification frameworks are highlighted as emerging solutions for enforcing boundaries programmatically.
HabrJul 25, 2026Translated from Russian