---
title: "Break the lethal trifecta · Agent Wranglers"
url: https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta
id: APS-84
level: Required
applies: ai-features
risk: data
updated: 2026-10-27
build: a2a6bdfed830
tokens: 758
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Break the lethal trifecta

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: APS-84
- Level: Required
- Chapter: [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md)
- Rule: Never give one agent all three of private data, untrusted content and a way to send data out. Remove at least one.
- Check: A test reads each agent's declared tools and marks which read private data, which read outside content and which can send data out. It fails on any agent that has all three. In staging, give the agent a page asking it to put a test record into a link to test.example.org. The test server receives no request.
- Risk: Data leaked or lost
- Applies when: The project uses AI models.
- How: List each agent's data, inputs and outputs. If it reads private data and outside content, block links, images, email and web requests that leave your site. Or split the work into two agents, so the one that reads outside content never sees private data.

## Sources

- [OWASP LLM01:2026 Prompt Injection](https://github.com/GenAI-Security-Project/GenAI-LLM-Top10/blob/main/2026/final/LLM01_PromptInjection.md)

## Related rules

- AID-73 [Allow agent network traffic only to listed hosts](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/egress-allow-list.md) in AI-assisted development
- AID-28 [Treat what the agent reads as untrusted](https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context.md) in AI-assisted development
- AIF-73 [Connect product agents only to tools and servers on a reviewed list](https://agentwranglers.se/playbook/ai-features/agents-in-products/reviewed-agent-tools.md) in AI features
- APS-83 [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/application-security/ai-features-and-agents/lethal-trifecta">Agent Wranglers application security playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Resist indirect prompt injection](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/indirect-prompt-injection.md)
- Next: [Give agent tools the least power they need](https://agentwranglers.se/playbook/application-security/ai-features-and-agents/least-privilege-tools.md)
- [AI features and agents](https://agentwranglers.se/playbook/application-security/ai-features-and-agents.md)