Defeating the lethal trifecta

Tue, 10 Mar 2026 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

Three legs

Simon Willison gave the pattern its name: the lethal trifecta is an agent that has all three of access to untrusted content, access to private data, and the ability to act or communicate outward. Each alone is fine. An agent that reads your email but can only draft replies is harmless; so is one that holds secrets but never sees an attacker’s words. Put all three in one process, though, and an instruction hidden in the untrusted content can walk a secret out the door.

A full-chain attack, contained

Tue, 02 Jun 2026 00:00:00 +0000

One email, every attack

The book has taken the attacks one at a time, which is how you learn them and not how they arrive. A real hostile email does not politely send its injection on Monday and its exfiltration on Tuesday. It packs everything into one message and hopes one thing gets through. So the capstone is a single email that tries the lot, run against the actual pipeline, with nothing mocked.

Defense-in-Depth on t0ul

Defeating the lethal trifecta

Three legs

A full-chain attack, contained

One email, every attack