Simon Willison’s Lethal Trifecta
If an LLM agent has tools that can:
- process untrusted input,
- access private and sensitive data, and
- communicate externally,
then an attacker can steal data via prompt injection.
As of 2026, this vulnerability is widespread across agentic LLM use cases.
The AEPD (Spain’s data protection authority) has issued the first guidance on agentic AI from an EU supervisory authority. It applies a ‘rule of two’ to the Lethal Trifecta characteristics to determine whether human oversight is required. In its version, the third characteristic is the ability to make autonomous decisions affecting individuals.