// GLOSSARY

Lethal Trifecta

The condition where an AI system simultaneously holds three capabilities: being able to reach private data, read untrusted content, and communicate outward. Each capability is legitimate on its own and often necessary; the danger arises from the three being present together. When this condition holds, indirect prompt injection turns directly into data exfiltration, and the mechanism is strikingly simple: the attacker writes a hidden instruction into untrusted content the model will read (an email, a web page, a document); as the model reads that content it mistakes the instruction for a command, gathers the private data it can reach, and sends it to the attacker through the outward communication channel. The analytic power of the concept is in reducing a complex threat to three clear conditions and turning the defense into a design decision. The defense logic is plain: removing any one of the three breaks the chain. Let the model not reach private data, or not process untrusted content, or not communicate freely outward. So when an AI application's architecture is designed, the question to ask becomes 'which of the three capabilities can I give up'; granting all three at once is a designed-in risk.