Lethal Trifecta

Opening

The lethal trifecta is Simon Willison's term from 2024 for three capabilities that, when combined in an agentic AI system, create an unavoidable prompt-injection vulnerability. Those capabilities are: (1) access to untrusted input that contains instructions, (2) access to sensitive tools that can take actions, and (3) access to persistent state or memory that survives across invocations. Willison argued that any system with all three properties is fundamentally compromisable. An attacker who controls any of the inputs can steer the agent into misusing any of the tools. The term was re-anchored in 2026 by Boris Cherny at Y Combinator when describing why Anthropic built the prompt-injection classifier for Claude Code.

Mechanism

The vulnerability mechanism is straightforward. A model that reads untrusted instructions (web pages, email, file contents, Slack messages) cannot reliably distinguish "this is data to be acted upon" from "this is an instruction to be followed." The prompt-injection attack exploits this ambiguity directly. If that same model also has tool access (shell, file system, network calls), the attacker can craft inputs that instruct the model to call those tools against the user's interest. If the model also has persistent state, the attack survives across sessions. Willison's "lethal" framing is that all three together are a guarantee of compromise rather than a risk to mitigate. Defenses can be layered, but the model must act on every instruction it processes, including malicious ones. Cherny notes that by 2026, Claude Opus 5 is "not prompt injectable anymore" through a combination of model-side alignment, mechanistic-interpretability-based detection (Crystal's neuron-firing patterns), and runtime classifiers.

Tradeoffs

The trifecta's framing creates an uncomfortable design constraint: any agentic system that reads the web and has tool access is, by Willison's definition, lethal. The trade-off is between agent capability (read, act, remember) and security guarantees (none of those). Real-world systems often pick two of three. For example, an agent that reads the web and has tool access but no persistent state is compromisable in a single session but does not leak state across sessions. An agent with persistent state but no untrusted-input access is constrained but safer. The architectural trade-off is whether to design agents narrowly (two of three) or build layers of defense on top of all three. Anthropic's approach with Claude Code takes the latter route.

Open Questions

Can models be trained to reliably refuse instructions inside data they read (the "instruction hierarchy" research direction), which would break the trifecta's first leg. Do mechanistic-interpretability classifiers (Crystal's neuron-firing approach) generalize across model families and attack patterns. Does the trifecta framing apply symmetrically to non-agentic systems. Is a search engine with no tool access but persistent state also lethal. Does the trifecta become a regulatory concept (specific bans on systems exhibiting all three properties) or remain a design heuristic.