auditing-the-lethal-trifectalisted

# Auditing the lethal trifecta: the agent exposure condition An AI agent turns dangerous when three capabilities share one trust context: - **Private data.** It can read secrets, user data, internal systems. - **Untrusted content.** It ingests text an attacker can influence. - **Exfiltration.** It can send data somewhere the attacker can observe. Any two of these are usually safe. All three together mean an attacker who plants content can make the agent read the private data and route it out, no account takeover required. The trifecta is a *structural* property of the agent's wiring, which is why it survives prompt-level defenses that a specific payload would slip. ## When to use - You are designing or reviewing a tool-using agent, assistant, or automation. - Before granting the agent a new tool, data scope, or network capability. - You found a prompt injection and need to know if it can cause real damage. - You are writing or reviewing an agent's permission and egress posture. ## Scope check Audit agents and systems you own or are authorized to test. Do not plant content in or exfiltrate from systems you do not control. If you can't name the authorization, stop. ## The loop 1. **Fix the trust context.** A context is one session, task, or conversation where content and capabilities mix, sharing the same model instance and memory. The trifecta must co-occur *within a single context* to bite; audit context by context, not tool by tool. 2. **Inventory capabili