1 min lesson
The lethal trifecta
For each case in "The lethal trifecta", name the signal and the response you would use.
Step 1 of 2
The lethal trifectathe condition that turns a quirk into an exfiltration
The cleanest mental model for when an agent becomes dangerous is the combination of three capabilities. Any one alone is survivable. Together they let untrusted text steal data.
The agent can read your repo, secrets, local files, internal APIs.
This is the whole point of the tool, so you can't just remove it.
It also reads things you didn't write: dependency READMEs, web pages, issue text, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. tool output.
Any of that can carry instructions.
It can make a network call, render a link or image or write to a path that leaves the boundary.
That's the channel data escapes through.
Your job as a security engineer is to break the trifecta. You usually can't drop the first two without killing the product, so most paved-road defenses attack the third and constrain the second: cut the exfil channels and quarantine or label untrusted content so the model is less likely to obey it.