Your coding agent can hold the lethal trifecta too

Fri, 25 Sep 2026 00:00:00 GMT

Link: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

Simon Willison’s lethal trifecta is the best one-line test I know for an AI agent. An agent is exposed when it has all three of: access to private data, exposure to untrusted content, and a way to communicate externally. With all three, anyone who can put text in front of the model can ask it to send your data out, and it may well do it.

I used it for business workflows in the least-autonomy post. The same test applies to the coding agent on your own machine, and that’s where it’s easiest to miss.

A coding agent already reads your repos, your .env files and whatever your shell can reach. That’s the first leg. Add an MCP server that reads GitHub issues, web pages or email, and you have the second: anyone can file an issue. Add web fetch, a tool that opens pull requests, or plain curl, and you have the third. Willison’s post cites a real case: the GitHub MCP server read a malicious public issue and leaked private repo data through a pull request.

Before you add the next MCP server, ask three questions:

What private data can this session reach?
What text in this session did someone else write?
What can this session send, post or fetch?

If all three have answers, take one away. Use a separate session for untrusted content, give it no secrets, or block outbound requests. Guardrail products that promise to catch “95% of attacks” don’t fix this. As Willison puts it, in web application security 95% is a failing grade.

Chad Norman: notes

Your coding agent can hold the lethal trifecta too