3 ms·
> The "lethal trifecta," as described by Simon Willison, is the combination of LLM agents, tool access, and long-term memory that together enable powerful but e
by furyofantares 1y ago
> The "lethal trifecta," as described by Simon Willison, is the combination of LLM agents, tool access, and long-term memory that together enable powerful but easily exploitable attack vectors.
This is a terrible description of the lethal trifecta, it lists 3 things but they are not the trifecta. The trifecta happens to be contained in the things listed in this (and other) examples but it's stated as if the trifecta is listed here, when it is not.
The trifecta is: access to your private data, exposure to untrusted content, and the ability to externally communicate. Web search as tool for an LLM agent is both exposure to untrusted content and the ability to externally communicate.
- swyx 1y agoyeah TFA gets it wrong. source: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
- gnabgib 1y agoThis post started there https://news.ycombinator.com/item?id=45307452 https://news.ycombinator.com/item?id=45307452 .. yes a different link, but this was originally linked to a simonw tweet, and he linked elsewhere.
- matusp 1y agoIn my opinion, the trifecta can be reduced further to a simple statement: an attacker who can input into your LLM can control all its resources.
- furyofantares 1y agoIt can, but it doesn't really help someone spot the danger.
- kragen 1y agoThat isn't a helpful statement, and it also isn't correct.
- jondwillis 1y ago“An LLM with a tool that READS untrusted content, is inherently also WRITING it into the context window.” Is a slightly more useful flattening/reduction of the problem that I’m still wordsmithing and evangelizing.
- Kevcmk 1y agoThis isn’t the trifecta. It’s: * Untrusted input * Privileged access * Exfiltration vector
- furyofantares 1y agoThose are different words for the same things. I think the reason for the original wording, which I pasted from the post it was coined in, is to make it more accessible than this, more obvious what you need to look out for. "Untrusted input" sounds like something I'm not gonna give an agent, "access to untrusted content" sounds like something I need to look out for. "Privileged access" also sounds like something I'm not gonna give it, while "access to my private data" is the whole reason I'm using it. "Exfiltration vector" may not even be a phrase many understand, "ability to communicate externally" is better although I think this could use more work, it is not obvious to many people that stuff like web search counts here.