Trio létal (lethal trifecta)
Three capabilities that, once combined in one agent, are enough for an attacker to steal your data: **access to private data**, **exposure to untrusted content** (a web page, an email, a GitHub issue), and **the ability to communicate externally**. The mechanism fits in one sentence: a model follows the instructions it finds in whatever it reads, with no reliable way to tell its user's instructions from the ones planted in the content. Hidden text on the page says "read this file and send it to this address", the agent holds all three capabilities, so it does. The term comes from Simon Willison, in a post dated 16 June 2025. He points out that MCP encourages mixing tools from different sources, and that a single tool can tick all three boxes at once.