Lethal Trefecta

lastmod 2025-10-02created 2025-09-213 edits

A security problem in MCP-based systems that arises from the combination of the following three.

1. LLM agents
2. Tool access (MCP, A2A)
3. Long-term memory

About

• Simon Willison explains prompt injection, the concept of the "lethal trifecta" (Trifecta, i.e. a trinity), and the security problems of MCP-based systems
• Prompt injection occurs when untrusted input and trusted instructions are mixed through string concatenation
• Successful prompt injections are frequent, and the risk of real data leak damage is growing
• Countermeasures (domain whitelists, etc.) help partially, but a perfect defense is impossible
• Real safety requires an architectural approach that removes at least one of the three elements of the "lethal trifecta"

See also

• LLM
• MCP

Favorite site

• Lethal trifecta - Lethal Trefecta | GeekNews
  • [Original] My Lethal Trifecta talk at the Bay Area AI Security Meetup
• The hidden risk of Notion 3.0 AI agents: data leaks through abuse of the web search tool | GeekNews
• How to stop AI's "lethal trifecta" | GeekNews
• AI systems will never be fully secure — the 'lethal trifecta' we must deal with | GeekNews