The Lethal Trifecta
Lethal trifecta - the three-capability threat model behind AI-driven data exfiltration - private data access, untrusted content exposure, and external communication - and how SealGate blocks it.
What is the Lethal Trifecta?
The lethal trifecta - a term coined by Simon Willison - is the combination of three capabilities that make data exfiltration possible when they are present together in one AI agent session: access to private data, exposure to untrusted content, and the ability to communicate externally. Any one alone is harmless; the risk appears only where all three overlap, and that overlap is what SealGate watches for.
The three capabilities
SealGate tracks each capability as a per-session flag that, once set, stays set for the rest of the session.
| Capability | Session flag | Remove it and… |
|---|---|---|
| Private data access | read_private_data | nothing valuable to steal |
| Untrusted content | read_untrusted_public_data | no way to inject instructions |
| External communication | write_operation | no way to send data out |
Once a session has read both private data and untrusted content, any external communication is paused for human approval.
How SealGate blocks exfiltration
Take a support agent connected through SealGate to an inbox, a customer database, and an outbound email tool:
Untrusted content in. The agent opens an attacker-submitted ticket carrying a hidden instruction. The untrusted-content flag is set.
Private data read. Following that instruction, it pulls the customer record, tagged PRIVATE. The private-data flag is set.
Exfiltration attempt. It calls the outbound email tool to send that record to the attacker - an external write.
Blocked at the boundary. All three flags are now set, so SealGate pauses the send for human approval. The record never leaves.
SealGate blocks on the capability combination the attack requires, which is finite and observable. It never has to identify the injection itself.
Session state and Access Control Levels
Because a flag is never unset, an injection cannot tell the agent to "forget" it has seen private data before the outbound call.
Access Control Levels are a second control, independent of the trifecta flags. PUBLIC data flows anywhere, PRIVATE cannot flow to a PUBLIC destination, and SECRET cannot flow to PRIVATE or PUBLIC - enforced even before the trifecta fully triggers. Both layers are configured as CEL-based policy rules; an admin sets each tool's Access Control Level when connecting a server, and Autoconfig proposes those levels automatically.
Why traditional security fails here
Firewalls, IAM, and DLP operate at the network and identity layers, verifying identity and whether a request is well-formed. What they can't see is the contents an agent has accumulated in its context across a session. A stolen record leaving over a valid, correctly-scoped API call looks identical to legitimate traffic. The trifecta is a context-level condition, and only something that sees the whole session - the gateway every call already passes through - can decide it.
FAQ
Put SealGate between your agents and your tools
One gateway that blocks the Lethal Trifecta, enforces access levels, and audits every tool call - no code changes to your agents.
Prompt Injection
Why injection is unsolvable at the text layer, and what to block instead.
MCP Malware Risks
How STDIO MCP servers create unmanaged attack surfaces.
Access Control
Tag tools and data PUBLIC, PRIVATE, or SECRET to control where it flows.
Policy Rules
Write CEL-based rules that enforce the trifecta and ACLs per organization.