Context EngineeringLesson 71 of 87

Contents

Context Engineering

Lesson 71 of 87. Sign in to keep your place.

Module 8 · Untrusted text and the trust boundary

Three ingredients, and the recipe only works with all three

8 min read

Three legs, and the attack needs all threeAccess to private dataMail, files, a database, a customer record. Scope itto the one document the user choseExposure to untrusted contentInbound mail, a fetched page, a shared file, asearch result. The hardest leg to removeA way to send data outwardsA rendered image, a link, a fetch tool, even asearch query. The most practical leg to removeRemove any one and it failsHowever well the payload is written, and whateverthe system prompt says about itThis is a property of the architecture rather than of the prompt, which is what makes it reviewable inan afternoon. It covers exfiltration only, so ask the second question too: what can this systemchange, and what happens if an attacker picks the change. An injected instruction that deletes a fileor quietly biases a summary steals nothing at all.
This is a property of the architecture rather than of the prompt, which is what makes it reviewable in an afternoon. It covers exfiltration only, so ask the second question too: what can this system change, and what happens if an attacker picks the change. An injected instruction that deletes a file or quietly biases a summary steals nothing at all.

Figure

The framing that makes the risk assessable

Simon Willison named this combination the lethal trifecta, and it is the most useful thing to hold in your head when reviewing an agent design, because it turns an open-ended anxiety into a three-item checklist.

An attacker aiming to steal data through an AI system needs all three of:

  1. Access to private data. The assistant can read something worth taking: mail, files, database rows, credentials, another customer’s records.
  2. Exposure to untrusted content. Some path exists by which an attacker’s text reaches the window.
  3. A way to communicate outwards. Some mechanism by which information can leave, reaching the attacker.

With all three, the attack is straightforward: the untrusted content instructs the model to read the private data and send it out. With any one missing, it fails.

The value of the framing is that it is a property of your architecture, not of your prompt. You can review a design against it in an afternoon, and the review yields concrete removals rather than vague resolutions to be careful.

Applying it

Take a plausible assistant: reads the user’s email, can fetch a web page a message links to, can send email on the user’s behalf.

  • Private data: yes, the mailbox.
  • Untrusted content: yes, anyone can send mail, and any linked page is attacker-controlled.
  • Outward channel: yes, it can send email.

All three. This design is not securable by prompt engineering, and a warning in the system prompt does not change the assessment. The honest conclusion is that one leg has to go.

Now take a second: a documentation assistant over your public docs, no user data, answers in the UI only.

  • Private data: no.
  • Untrusted content: the docs, if anyone outside can edit them.
  • Outward channel: no tools.

One leg, maybe two. An injected instruction can make it give a wrong or embarrassing answer, a real problem, and a reputational one, but there is nothing to steal and no route out. The appropriate controls are editorial, not architectural.

Which leg to remove

Removing private data is usually cleanest when it is possible. Scope the assistant to a specific document the user selected rather than to their whole drive. Give it the row it needs rather than a query tool over the table. The principle is ordinary least privilege, and in this context it is unusually effective because the model cannot leak what it was never given.

Removing untrusted content is the leg people reach for and it is the hardest to hold. It means the assistant cannot follow links, cannot read inbound mail, cannot search the web, cannot ingest user uploads. For most useful products that is most of the product. Where it is achievable is inside a closed corpus with controlled authorship, and you should be sceptical of how controlled it is.

Removing the outward channel is the most practical in the largest number of cases, and it is also the one where teams underestimate what counts as a channel. That is the entire subject of the next lesson, and it is more surprising than it sounds.

The part the framing does not cover

The trifecta is about exfiltration. Injection can do other harm that the three-item check does not catch.

An injected instruction can cause destructive action: delete files, cancel orders, close tickets, send a message that damages a relationship. No private data needs to leave for that to be serious. A system with untrusted content and any write capability is exposed, whether or not it can read anything sensitive.

It can also corrupt the answer: make a summary omit a clause, make a comparison favour one product, make a code review approve a change. Nothing leaves, nothing is deleted, and the user acts on a wrong output. This is the hardest variant to detect because there is no event to detect.

So use the trifecta as the first filter and then ask the second question: what can this system change, and what happens if an attacker chooses that change. Together they cover most of the ground.

Put it in the review

Make the three questions a required section of any design document for a system that calls a model with tools. Four lines: what private data is reachable, what untrusted content can arrive, what can leave, what can be changed.

It is a low-effort control with an unusually good record, because the failure it catches is not subtle: it is a design that has all three legs and nobody sat down to notice. Teams that ask the question rarely ship that design. Teams that do not, ship it regularly, and find out later.

Every lesson here is open. Your progress is recorded once you pass the Data, SQL and Getting to the Answer exam.

Check your understanding

An assistant reads a user’s private files and can fetch arbitrary web pages, but has no tool that sends anything outward and renders no remote content. What is the residual exfiltration risk?

Pick the one you would defend. Your answer stays private.

Next lesson · 9 minThe outward channels you did not know you had

Stuck on something?Ask Sayali, your AI tutor

Previous lesson: The attacker is not the one typing

How to cite: Addaly (2026) ‘Three ingredients, and the recipe only works with all three’, in Context Engineering. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/context-engineering/the-lethal-trifecta (Accessed: 13 October 2026).