The Lethal Trifecta Is Everything Zero Trust Was Built to Stop

A security leader I follow dropped a post last week that I haven’t been able to shake. Over the past month, they had sat through discovery calls with more than thirty vendors, every single one selling something called “AI security.” Each of them was asked the same plain question: how does your product stop the lethal trifecta?

Almost nobody recognized the term. One or two could actually engage with it. Everyone else went quiet. Let’s be honest about what that tells you. If the vendors selling you “AI security” can’t name the central attack pattern of the agentic era, you have a problem—and it’s not their problem.

I’ve been chewing on this for a while, because the lethal trifecta is the photographic negative of the most prominent game-changing mindset: that trust should never be assumed. It has to be earned, verified, and earned again. That idea has a name, zero trust, and over the last decade it went from radical to obvious. The lethal trifecta is what happens when we throw all of that away.

So let’s start at the beginning.

What is the Lethal Trifecta?

The term came from the same person who named prompt injection (which is not a coincidence).

Simon Willison coined “lethal trifecta” in June 2025. If that name sounds familiar, it should: he’s also the engineer who gave us “prompt injection” He named that one after SQL injection deliberately, because the underlying flaw is identical: mixing trusted and untrusted content in the same execution context.

His observation about the trifecta is almost embarrassingly simple. An AI agent becomes a loaded weapon pointed at your own data the moment it combines three capabilities:

• Access to private data: your inbox, customer records, source code, file shares.
• Exposure to untrusted content: anything an attacker can get in front of the model, an email it reads, a web page it browses, a support ticket it ingests.
• The ability to communicate externally: sending an email, calling an API, posting to a URL.

Any one of these alone is fine. Two of them, and you’re usually still okay. Put all three in the same agent, in the same context window, and you’ve built a machine an attacker can hijack with nothing more than a cleverly worded sentence buried in a web page.

No malware. No exploit. No CVE. Just text that the model obeys without question, because to the model, your instructions and the attacker’s instructions look exactly alike.

Think of it as the fire triangle for the AI era: heat, fuel, oxygen. Remove any one and the fire goes out. Keep all three present and combustion is only a matter of time. We already have examples. The “EchoLeak” vulnerability in Microsoft Copilot was a textbook trifecta exploit: a poisoned input quietly steered an agent with data access toward exfiltration, with zero user action required. It happened in the wild, not in a lab.

The trifecta is zero trust inverted, point for point

Here’s what stopped me cold, and why I think you need this framing specifically.

Zero trust is a discipline of decomposition. You take a request and you break it apart. Who is this identity? Is it verified right now? Does it have least-privileged access to this resource, for this action, in this moment? Deny by default. Segment everything. Assume breach and treat every actor, every packet, accordingly.

The lethal trifecta is what happens when all of that collapses back into a single, undifferentiated blob of implicit trust.

The agent isn’t verified per request: it’s granted standing, persistent reach over whatever its tools can touch. It doesn’t operate under least privilege either; it inherits the union of every privilege every connected tool holds. Breach is never assumed, good faith is. Data, input, and egress don’t stay apart: they dissolve into one shared context where private data, attacker-controlled text, and an open outbound channel all swim together.

Look at it point for point:

• Verifying every request vs. granting one standing, implicit trust.
• Least privilege vs. aggregating maximum privilege.
• Assuming a breach vs. assuming good faith.
• Segmenting and denying by default vs. merging everything and allowing by default.

Zero trust was our answer to the inevitable collapse of the architecturally unsound network perimeter. The lethal trifecta is the same lesson at the data and agent layer.

The trifecta is hiding in your data lineage right now

Here’s what makes this genuinely unsettling: you don’t have to build an exotic agent to assemble the trifecta. Any data store that’s broadly accessible and feeds a model, whether as training data or live retrieval context, already has all three legs by default.

Walk through it with me.

A shared vector database or knowledge corpus holds sensitive material the model can surface. Access to private data: present. It’s used to answer users and increasingly takes actions for them based on the corpus and tools connected. External communication: present. And because almost anyone can write to it, every document sitting in that corpus has to be treated as a potential instruction, not passive data. That’s the last leg of the trifecta, switched permanently on.

The moment a corpus is writable by people you don’t fully trust, the content loaded into it is untrusted input, and inside most retrieval systems, untrusted input is executable. The public web scraped into a training set is the purest version of this: untrusted content at planetary scale, poured straight into the model’s foundation.

This is exactly what the ConfusedPilot research demonstrated. Working in Professor Mohit Tiwari’s SPARK Lab at UT Austin, the Symmetry team showed that an attacker needs nothing more than the ability to drop a file into a corpus that a RAG system like Microsoft 365 Copilot references. The poisoned document gets retrieved. The model folds its contents into the prompt. The attacker steers the answer. As Tiwari put it: “the attack is as easy as uploading a file, and the defense is hard.” Worse, the effect can linger even after the malicious file is deleted.

You cannot tell a poisoned record from a legitimate one by reading it. They look identical. The only thing that separates them is who can access it and who has changed it.

Strip away provenance and every row in your corpus is equally suspect. Which means you’re forced to leave the untrusted-content leg on for everything, all the time. That reframes the whole problem. Cutting a leg of the trifecta in a retrieval system is, concretely, a data-lineage problem. If you can attribute every record to a trusted source and a trusted writer, you can quarantine it, down-rank it, or refuse it. If you can’t, you’re handing your output to whoever had ‘write’ access to your data.

Prompt filtering matters, but sadly, it’s not enough

Let’s be honest about the first instinct here, because it’s the wrong one.

The first thing most teams do is reach for prompt inspection: intercept each input, classify the malicious ones, block them before they reach the model. This matters. A strong prompt protection layer should be table stakes for anyone putting agents into production, and it raises the cost of an attack considerably.

Why filtering prompts isn’t a defensive strategy

No classifier catches everything. An adversary who can try a thousand variations only needs one to land. Inspection narrows the opening. It does not close it.

The layer that closes it is structural. It’s the one Willison himself points to: cut a leg. Make it architecturally impossible for all three capabilities to coexist in one trusted context. Don’t let the agent reach private data. Or don’t let it see untrusted content. Or don’t let it exfiltrate.

For most real-world agents, the most practical leg to sever is the relationship between data and egress: tightly governing what data an identity (human or agent) can actually reach, and where it’s allowed to send it.

That should sound familiar. It’s Zero Trust, applied to a single pillar: the data itself.

The trust boundary has moved again with AI, and it’s sitting on your data plane

Zscaler operationalized zero trust for the network. Then extended it to identity. The lethal trifecta is the signal that the next place to apply these same principles is the data plane.

The perimeter has moved again. It’s now the data an agent can reach, and the path by which that data can leave.

You can’t cut a leg of the trifecta you can’t see. That’s the work we’re focused on at Zscaler in AI Security: bringing the same zero-trust rigor we applied to traffic and identity down to the data layer. Mapping precisely which identities and agents can touch which sensitive data. Closing the exfiltration path before an attacker goes looking for it. Symmetry’s AI access graph was built for exactly this question, and folding it into Zscaler’s zero-trust platform feels less like an acquisition than a homecoming.

What this means for you right now

If you’re a CISO or security leader evaluating AI security vendors, or building agentic systems yourself, here’s the practical read-out.

• Ask every vendor the trifecta question: If they don’t recognize the term, that tells you something important about how deeply they’ve thought about agentic security and engaged with the wider industry. The vendors who can’t engage with the foundational attack pattern of the era they’re supposedly securing are selling you a label, not a solution.
• Audit your retrieval pipelines for all three legs: Don’t just ask “is this agent secure?” Ask: does it have access to private data? Does it ingest untrusted content? Can it send information outside your environment? If the answer to all three is yes, you have a live trifecta, regardless of what security tooling is layered on top.
• Treat data lineage as a security control: Provenance isn’t a compliance checkbox. It’s the mechanism that lets you distinguish a legitimate record from a poisoned one. If you can’t attribute data to a trusted source and trusted writer, you cannot cut the untrusted-content leg, full stop.
• Think structurally, not just defensively: Prompt filtering is necessary. It is not sufficient. The durable fix is architectural: enforce least privilege at the data layer, segment agent capabilities, and make exfiltration paths explicit so you can govern them.

Zero trust taught us never to assume. The lethal trifecta is what assumption looks like when we forget. Let’s not forget.