Three permissions that each look harmless become a data-exfil pipeline the moment one agent holds all three. The frame, the trap, and the containment play.
This is why it makes me nervous that my bank has a CLI now. If there's one institution or organization that I can think of that I want to have an API less than my BANK…I can't think of it. Let's increase the attack surface of the resources voted Most Likely to Be Stolen. 🙄
I get that we've been automating financial transactions for decades, usually in batches. I did several tours of duty consulting as a Biztalk architect for orchestrating SWIFT systems and its descendants. We just never put a nondeterministic participant inline with any of it (unless you count the human workflow nodes). I can't imagine a nondeterministic "agentic" controller in charge of money flow is a good idea, especially if every possible input it reads is treated like a privileged prompt.
totally agree. watching some industries adopt ai is fun. others i feel should wait a few years for the kinks to be worked out… like anything with my money lol.
"Autonomous agents get hacked because the model cannot tell the difference between instructions from its operator and data it reads while working" Great framing. I wonder if anyone is trying to solve this problem. Going on my list for research
If the root cause is that the model can't distinguish instructions from data, and the human operator delegates trust to that model, doesn't that makes the operator's cognition part of the attack surface?
The model becomes a confused proxy but the human is the one granting the permissions and reading the outputs.If an attacker can modulate what the agent says or does, they're indirectly modulating what the operator perceive and decide.
Wonder if there is emerging documentation about this "cognitive attack surface" layer or if it's still bundled under "prompt injection"?
yeah, you’re onto something real. the operator’s cognition is part of the attack surface, and the field just crams it under “prompt injection” because that label got there first.
model-as-confused-deputy is only half the chain. the other half is the human trusting model output as ground truth.
attacker doesn’t pop the operator, just steers what they see. closest named framing is the lethal trifecta, but nobody’s cleanly labeled the perception layer yet. good instinct to split it out.
The lethal trifecta is the most elegant threat model I've seen this year. Private data + untrusted input + external comms in one session. Remove any one leg and the attack chain collapses. Simple in theory, terrifying in practice.
But here's what nobody talks about — a compromised agent and a productive one look completely identical until the data is already gone. You can't catch it in outputs. You need decision-level logging on every high-risk action before it executes.
"Assume injection will succeed, then contain the blast radius" is the only honest security posture right now. The semantic gap isn't a bug to patch — it's architectural.
So the real question isn't whether your agent can be hijacked. It's whether your blast radius is small enough to survive it.
The “Lethal Trifecta” is important because it finally forces the industry to admit that the problem isn’t model intelligence. The problem is authority. An AI agent becomes dangerous when it has:
1. Access to sensitive data
2. Exposure to untrusted content
3. The ability to take action or communicate externally
Most security vendors are responding by trying to make agents better at recognizing bad instructions. DataFenz would argue that’s the wrong layer.
The lesson isn’t that agents need more detection.
The lesson is that execution requires control.
An autonomous agent that can read data, process malicious input, and take action is facing the same challenge organizations face with ransomware:
* Detection explains what happened.
* Governance documents describe what should happen.
* Execution control determines what actually happens.
The real question is:
What intervenes when an AI agent starts making the wrong decision in real time?
DataFenz views the Lethal Trifecta as another example of a broader security truth:
Visibility is not the problem. Execution control is the missing capability.
Whether it’s ransomware encrypting data, an insider copying data, or an AI agent exfiltrating sensitive information, the failure occurs at the moment an unauthorized action is allowed to execute.
The future of AI security will not be won by teaching agents to behave better.
It will be won by enforcing deterministic authorization at the point of execution.
No unauthorized action. No data loss. No leverage.
As always, feel free to AMA. another one born out of frustration, trial and error.
I believe we'll reach AGI only when the models will be close to impossible to fool.
that’s definitely going to be a good mile marker. i agree.
This is why it makes me nervous that my bank has a CLI now. If there's one institution or organization that I can think of that I want to have an API less than my BANK…I can't think of it. Let's increase the attack surface of the resources voted Most Likely to Be Stolen. 🙄
I get that we've been automating financial transactions for decades, usually in batches. I did several tours of duty consulting as a Biztalk architect for orchestrating SWIFT systems and its descendants. We just never put a nondeterministic participant inline with any of it (unless you count the human workflow nodes). I can't imagine a nondeterministic "agentic" controller in charge of money flow is a good idea, especially if every possible input it reads is treated like a privileged prompt.
totally agree. watching some industries adopt ai is fun. others i feel should wait a few years for the kinks to be worked out… like anything with my money lol.
"Autonomous agents get hacked because the model cannot tell the difference between instructions from its operator and data it reads while working" Great framing. I wonder if anyone is trying to solve this problem. Going on my list for research
really appreciate that. from what i’ve seen, anthropic is aware of and attempting solutions, but still an active area of research.
Great breakdown of the trifecta.
One thing I am trying to map:
If the root cause is that the model can't distinguish instructions from data, and the human operator delegates trust to that model, doesn't that makes the operator's cognition part of the attack surface?
The model becomes a confused proxy but the human is the one granting the permissions and reading the outputs.If an attacker can modulate what the agent says or does, they're indirectly modulating what the operator perceive and decide.
Wonder if there is emerging documentation about this "cognitive attack surface" layer or if it's still bundled under "prompt injection"?
yeah, you’re onto something real. the operator’s cognition is part of the attack surface, and the field just crams it under “prompt injection” because that label got there first.
model-as-confused-deputy is only half the chain. the other half is the human trusting model output as ground truth.
attacker doesn’t pop the operator, just steers what they see. closest named framing is the lethal trifecta, but nobody’s cleanly labeled the perception layer yet. good instinct to split it out.
The lethal trifecta is the most elegant threat model I've seen this year. Private data + untrusted input + external comms in one session. Remove any one leg and the attack chain collapses. Simple in theory, terrifying in practice.
But here's what nobody talks about — a compromised agent and a productive one look completely identical until the data is already gone. You can't catch it in outputs. You need decision-level logging on every high-risk action before it executes.
"Assume injection will succeed, then contain the blast radius" is the only honest security posture right now. The semantic gap isn't a bug to patch — it's architectural.
So the real question isn't whether your agent can be hijacked. It's whether your blast radius is small enough to survive it.
fantastic final statement there. feels like it’s all about the blast radius with this new paradigm.
DataFenz Perspective
The “Lethal Trifecta” is important because it finally forces the industry to admit that the problem isn’t model intelligence. The problem is authority. An AI agent becomes dangerous when it has:
1. Access to sensitive data
2. Exposure to untrusted content
3. The ability to take action or communicate externally
Most security vendors are responding by trying to make agents better at recognizing bad instructions. DataFenz would argue that’s the wrong layer.
The lesson isn’t that agents need more detection.
The lesson is that execution requires control.
An autonomous agent that can read data, process malicious input, and take action is facing the same challenge organizations face with ransomware:
* Detection explains what happened.
* Governance documents describe what should happen.
* Execution control determines what actually happens.
The real question is:
What intervenes when an AI agent starts making the wrong decision in real time?
DataFenz views the Lethal Trifecta as another example of a broader security truth:
Visibility is not the problem. Execution control is the missing capability.
Whether it’s ransomware encrypting data, an insider copying data, or an AI agent exfiltrating sensitive information, the failure occurs at the moment an unauthorized action is allowed to execute.
The future of AI security will not be won by teaching agents to behave better.
It will be won by enforcing deterministic authorization at the point of execution.
No unauthorized action. No data loss. No leverage.
That’s not an AI problem.
That’s a control problem.
Jack Fitzpatrick
Vice President - Data Protection
DataFenz
jack@DataFenz.com
770-289-6945
great points here. thanks for sharing.