Lenny RachitskyHost of Lenny's Podcast | Author of Lenny's Newsletter

What is the lethal trifecta?

8 Apr 2026 · 1 min

Watch on YouTube

1:06

Prompt injection attacks need three things to succeed: an agent with access to sensitive data, a way to inject malicious instructions, and a way to steal data back out. An email system reading private messages is the classic example. Breaking any one of these three legs stops the attack.

Chapters

So prompt injection is the class of vulnerabilities in applications we build on top of LLMs. I didn't discover this problem, but I was the first to stamp a name on it. The problem is the name itself is misleading. You hear prompt injection and think, oh, I can solve SQL injection. I'll use the same thing. That doesn't work. The lethal trifecta was my second attempt at this. And you'll notice that the lethal trifecta, you cannot guess what it is. It's 3 things, but what are those things? And that means I get to control what it means because you have to go and look it up when you hear what it is. You have a lethal trifecta anytime your agent has 3 things. It's got access to private information. It's exposed to malicious instructions. So there's a way somebody attacking you can get their text into your system. And the third leg is exfiltration, or some mechanism that the agent can send data back to that attacker. So if you've got a system where you've got private emails, anyone can email you instructions, and it can email them back, that's the classic lethal trifecta. That's a huge security problem. The only way to fix it is to cut off one of those 3 legs.