An agent that reads untrusted text, holds sensitive data, and can reach the network will eventually do all three in the wrong order. Cut one leg in the architecture; guardrails go on top of the cut, never instead of it.

The mechanism

Everything an agent receives arrives as one token stream. The system prompt, the user’s question, a retrieved PDF, a tool’s description of itself, an API response: same channel, no provenance tag the model can be relied on to honour. Simon Willison named the consequence in June 2025. Give one agent access to private data, exposure to untrusted content, and the ability to communicate externally, and the result is an exfiltration path that runs on the agent’s own credentials.

Willison’s calibration is usually lost in retelling, and the loss matters. Models are unable to reliably distinguish the priority of instructions by origin. Obeying a planted instruction is probable, not certain: measured hijack rates across the benchmark literature run from under 1% to 98.4% depending on model and attack family. His conclusion from that is the useful one. A guardrail advertised at 95% is not a security control, because an attacker who can retry never faces the 95%.

Why three legs beat the sum of one is clearest in the MCP security preprint’s formulation, which splits the agent’s world into the system supplying instructions, the system holding data, and the system receiving output. An attacker can post a comment on a public page. They cannot reach the firm’s positions database or its outbound mail. The agent reaches all three and supplies transitive reachability the attacker never had; the harm is that reachability rather than a model being fooled.

Nobody assembles this on purpose. MATRA’s study of OpenClaw is the cleanest published instance: one agent taking untrusted input from email, web and messaging; holding sensitive data through a production PostgreSQL shared with the web application and payment workers, plus a .env of database credentials and third-party API keys; and reaching outward through curl, a messaging tool on the gateway host, and auto-fetch of URLs in rendered markup. Every one of those tools was added for a defensible reason. The trifecta is what a capable general-purpose assistant looks like by default. (MATRA never uses the word “trifecta”; the mapping onto its facts is ours.)

This is the baseline standards bodies are scoping rather than an exotic configuration. NIST’s COSAIS concept paper (August 2025) sketches a single-agent coding assistant with repository write access, commit rights, test execution, web browsing and deployment assistance over MCP: all three legs, presented as an ordinary scenario. The controls for it are still missing. As of August 2026 NIST has published only an annotated outline covering predictive AI, with no agent overlay. Guidance is describing a configuration it cannot yet say how to secure.

What to do

Use the model as an intake question rather than a philosophy. For every agent, name the leg that is missing. An agent with no nameable missing leg is where the work is.

The cheap version is three columns in the agent registry: does it read anything a stranger can write, does it hold data the firm would report to a client or a regulator, can it reach a destination outside the firm’s control. Three yes answers means the agent needs an owner and a date, today. It is a spreadsheet exercise, and the highest-yield hour in agent governance: it turns an argument about model safety into a list of named systems.

Then cut, choosing by whichever leg the agent’s actual job can spare:

• Egress is usually cheapest and rarely part of the work. Most internal agents need to read widely and write to one or two known places, so a default-deny destination policy costs little utility. See egress control.
• Sensitive data is next. Scope the agent’s own credentials to the task rather than to its owner’s entitlements. See data access governance.
• Untrusted input is hardest, because reading the world is usually the point. Where it cannot be cut, quarantine it so untrusted text can inform a plan without authoring one. See dual-LLM quarantine and the zone boundaries in three-zone architecture.

Guardrails come after the cut. They are worth having, because they catch degradation cases architecture misses, but they are no substitute for it. See runtime guardrails.

How you’d know it’s working

Two observables; the second separates real containment from theatre.

Every agent above the lowest risk tier shows a named missing leg in the registry, with the enforcement point recorded. A registry entry reading “we reviewed this” fails that test; one reading “egress policy agent-42-allow, three destinations.” passes it.

And when an injection attempt runs, the block shows up in the egress or authorization log rather than the classifier log. That distinction is the whole signal. A filter block shows that the filter recognised this phrasing. A destination-unreachable block shows that the class is closed regardless of phrasing. Red-team results that only ever appear as classifier hits mean a filter was bought and no leg was cut.

Be honest about the limit of the evidence. No public incident record documents an end-to-end trifecta exploitation at a financial firm; every instance available today is a lab study, a reference scenario, or a definition. The answer to a CEO asking whether this has happened to a fund is that nobody has published one and that the mechanism is well-demonstrated in controlled settings. Nobody should read that absence as comfort: the realised incidents in adjacent categories (see prompt injection) required no user click.

What this doesn’t solve

The trifecta is a model of theft, and theft is one of several ways an agent goes wrong.

An agent with sensitive data and no egress at all can still delete the wrong rows, send the wrong internal instruction, or produce a confidently wrong number that someone trades on. Cutting legs bounds where data can go; it says nothing about destruction, and nothing about judgment. That is unreliable output, a separate failure with separate controls.

Allowlisted destinations remain destinations. An agent permitted to email clients can email them the wrong thing, and an approved CRM is a fine place to stage data for a human insider to collect later. Cutting a leg narrows a channel and leaves every permitted use of it open.

Deliberate misuse by the agent’s owner sits outside this frame.

One sourcing caveat: the three-legs reading of the NIST, MATRA and Citi material above is our inference over their facts rather than their framing. Citi described the premise in January 2025, five months before the term existed, without naming the untrusted-input leg. Treat the convergence as evidence that practitioners keep arriving at the same shape rather than as a citation for the term.

See also

• Prompt injection and goal hijack — the concrete failure this model explains, with the incidents that actually happened.
• Data exfiltration — what a completed trifecta produces.
• Egress control — the leg to cut first, and its real limits.
• Data access governance — cutting the sensitive-data leg instead, when egress is load-bearing.
• Dual-LLM quarantine — keeping untrusted input while denying it control flow.
• MCP — what turns assembling all three legs into a configuration choice.