"If you are a user of LLM systems that use tools (you can call them “#AI agents” if you like) it is critically important that you understand the risk of combining tools with the following three characteristics. Failing to understand this can let an attacker steal your data.
"The lethal trifecta of capabilities is:
"1. Access to your private data—one of the most common purposes of tools in the first place!
2. Exposure to untrusted content—any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM
3. The ability to externally communicate in a way that could be used to steal your data"
https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/