TL;DR: AI agents that can read private data, process untrusted content, and send data externally create a prompt-injection path to exfiltration, according to Promptfoo’s analysis of the “lethal trifecta” and red-teaming workflow. The control problem is not model cleverness but limiting the combined trust, content, and output conditions that let malicious instructions become data loss.
At a glance
What this is: Promptfoo maps the AI agent “lethal trifecta” to a governance gap: private data access, untrusted inputs, and outbound communication together create a prompt-injection and exfiltration risk.
Why it matters: IAM, NHI, and AI security teams need to treat agent permissions as a combined access pattern, because the risk emerges from how data, trust, and egress intersect, not from model output quality alone.
Context
The core issue is governance, not model intelligence. When an AI agent can read sensitive context, consume untrusted input, and communicate externally, the organisation has created an access path that can be steered by malicious instructions.
This is a genuine identity and access problem because the agent behaves like a non-human actor with delegated reach. The article’s concern is typical of emerging AI programmes: teams add tools and connectors faster than they define the controls that constrain how far those agents can act.
Key questions
Q: What breaks when an AI agent can read private data and send it externally?
A: The agent can become an exfiltration path instead of a productivity layer. If attacker-controlled content reaches the agent at the same time as sensitive data and outbound communication tools, prompt injection can turn ordinary workflow actions into disclosure. The failure is architectural, because the agent has enough privilege to act on malicious instructions while appearing legitimate.
Q: Why do AI agents with outbound channels create higher exfiltration risk?
A: Outbound channels give a malicious instruction somewhere to go. If the agent can chat, email, or make external requests, then leaked content does not need to stay inside the model. The risk increases sharply when those channels sit next to private data access, because the agent can be induced to move sensitive information across the boundary itself.
Q: What are the signs that an AI agent is being given too much operational trust?
A: Look for broad tool reach, inconsistent stop behaviour, action without strong environment evidence, and access that survives beyond the task. Those symptoms indicate the agent has drifted from a bounded assistant into an over-privileged system with hidden authority.
Q: How should organisations govern AI agents that need database access?
A: Organisations should give AI agents narrow read access by default, separate write privileges from query privileges, and require human approval for any session that can modify data. That keeps agent activity inside a clearly bounded role while preserving auditability and reducing the chance of unsupervised state change.
Technical breakdown
Why the lethal trifecta is an access control problem
The lethal trifecta is not a single exploit. It is a risky operating condition created when three capabilities coexist: access to private data, exposure to untrusted content, and an outbound communication path. In that state, prompt injection becomes a control bypass because the model is being asked to reconcile instructions from trusted system context and attacker-controlled content at the same time. The security failure is structural: the agent can retrieve, reason over, and transmit data inside one workflow. That means the control boundary must exist before inference, in the permissions and data paths that shape what the agent can touch.
Practical implication: shrink the agent’s data and egress permissions before relying on prompt filters.
Why red-teaming agent exfiltration needs realistic context poisoning
Prompt injection tests work best when they reflect how attackers actually smuggle instructions into content the agent is expected to read. That can be an email, webpage, document, or retrieved knowledge source. The important technical point is that the malicious instruction does not need to arrive through the user prompt. If the agent can ingest arbitrary content and then act on it, the attacker can hide instructions in the very material the system is designed to process. Testing must therefore combine private data exposure, poisoned context, and a believable output channel, or it will miss the real failure mode.
Practical implication: test indirect injection paths through every untrusted content source the agent can consume.
Why deterministic API boundaries matter more than model prompts
The article’s strongest control recommendation is to add deterministic guarantees to the APIs the agent uses. That means the surrounding system, not the language model, must decide whether a data lookup, email send, or external request is allowed. Model instructions can reduce risk, but they are not a reliable enforcement layer because an attacker can rephrase the malicious request in many ways. In practice, the agent should only be able to access data and trigger actions through narrowly scoped, observable interfaces. This is especially important for workflows that mix retrieval, reasoning, and output in one chain.
Practical implication: enforce allow-listed tool calls and explicit action boundaries around any agent that can move data outward.
Threat narrative
Attacker objective: The attacker wants the agent to disclose private data or relay it externally by turning trusted agent behaviour into an exfiltration channel.
- Entry occurs when malicious instructions are embedded in untrusted content the AI agent is expected to process, such as a web page, document, or message.
- Credential_harvested is not the main step here; the more relevant stage is data access, where the agent can read private notes, records, or other sensitive context.
- Escalation happens when the agent follows attacker-supplied instructions and combines its private data access with an outbound channel to reveal or transmit information.
- Impact is data exfiltration through a chat response, email, web request, or other external communication path that carries sensitive content outside the trust boundary.
Breaches seen in the wild
- CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
- Langflow Flodrix botnet 2025: Attackers used Langflow's unauthenticated code endpoint to dump AI servers' environment variables and enlist them in the Flodrix botnet.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
The lethal trifecta is a governance failure, not an LLM failure. The article is describing a condition where access to private data, exposure to untrusted content, and outbound communication coexist inside one workflow. That combination turns the agent into a non-human identity with delegated reach that can be manipulated through content. Practitioners should treat the control problem as permission design, not prompt wording.
Agent security is really API security when the model can act on data. The article is right to push deterministic guarantees into the underlying APIs because prompts cannot reliably enforce boundaries. Once an agent can query data and trigger actions, the decisive question becomes whether each tool call is separately authorised and observable. Teams should govern agent actions at the interface layer, not assume the model will self-restrict.
Prompt injection becomes materially worse when egress is left open. The risk is not simply that an agent reads sensitive information, but that it can transmit that information through chat, email, or external requests. That creates a direct bridge from untrusted input to exfiltration. Practitioners should therefore review outbound channels as part of identity and access design, not as a separate concern.
Least privilege for AI must include content trust boundaries. Traditional least privilege focuses on what a subject can access, but agentic systems also need limits on what content they are allowed to consume and trust. The article’s lethal trifecta is a clear example of why access reviews alone are insufficient if the ingestion path remains open to attacker-controlled instructions. Security teams should scope data, tools, and communication together.
From our research library:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Read next: AI Agent Identity Security Buyer's Guide
What this signals
Lethal trifecta control is now an identity design problem. The important shift for practitioners is that AI agents must be governed like delegated subjects with constrained access, not like passive software features. If the agent can see sensitive data, trust arbitrary content, and talk outward, the boundary has already failed. Teams should make issuance-time control, tool scoping, and egress review part of the access model from the start.
AI agent governance will increasingly converge with NHI governance. The same questions that matter for service accounts now matter for agentic systems: who owns the identity, what can it see, what can it do, and when does it stop. This is where IAM, PAM, and AI security meet in practice. Organisations that keep treating agent permissions as a model-layer issue will miss the real enforcement point.
Least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. According to the 2026 Infrastructure Identity Survey, organisations failing to scope AI access properly are 4.5x more likely to experience a security incident. That gap is a strong signal that agent governance has to move from experimentation to control design.
For practitioners
- Constrain agent data access to the minimum necessary Remove broad read access to files, email, databases, and memory unless the task genuinely requires it. Treat every additional source as part of the attack surface, not a convenience feature.
- Block untrusted content from reaching decision paths Sanitise or sandbox external documents, web pages, and messages before they are handed to an agent for summarisation or action. If the agent must ingest them, separate retrieval from instruction-following.
Key takeaways
- AI agents become materially more dangerous when private data access, untrusted inputs, and outbound communication are combined in one workflow.
- The article frames prompt injection as a structural access problem, not a model-quality problem, which shifts control ownership toward IAM and API governance.
- Practitioners should reduce exposed data, restrict tool use, and constrain egress before relying on filters or prompts to contain agent behaviour.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | The article centres on agent permission misuse and delegated access abuse through prompt injection. |
| ASI09 — Human-Agent Trust Exploitation | Untrusted content manipulates the agent’s trust in external instructions. | |
| Recommendation — Constrain agent privileges and separate data access from action execution to reduce identity abuse. Treat all external content as adversarial input and validate it before the agent acts on it. | ||
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Outbound agent actions can expose sensitive workflows and data through loosely governed APIs. |
| Recommendation — Restrict agent tool calls to approved business flows and monitor any data-moving action. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The attack pattern combines sensitive data access with outbound leakage. |
| Recommendation — Map agent red-team findings to credential access and exfiltration tactics in your detection workflow. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The central gap is excessive permissions across data, tools, and egress channels. |
| Recommendation — Review AI agent entitlements so data access and tool use stay within least-privilege boundaries. | ||
Key terms
- Lethal Trifecta: A risky AI agent condition where one system can read private data, consume untrusted content, and communicate externally. When those three capabilities overlap, the agent can be tricked into disclosing sensitive information through legitimate tools without a conventional exploit.
- Indirect Prompt Injection: Indirect prompt injection is an attack where malicious instructions are hidden inside content that an AI system reads later. The model may treat that content as context rather than as hostile input, which can influence tool use, data access, or workflow actions if controls are weak.
- Data Exfiltration Path: A data exfiltration path is the route sensitive information takes when it leaves an organisation’s controlled environment. In Shadow AI cases, the path may be a prompt field, browser extension, or personal account rather than a file transfer or network event.
- Agent Egress Control: Agent egress control is the governance of where an AI agent can send data, which tools it can call, and what external destinations it may reach. It is essential when agents can transform internal information into outbound requests that may leak sensitive content or trigger unintended actions.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and agentic AI identity. It helps security and IAM practitioners translate delegated access into enforceable controls.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org