The lethal trifecta is the core risk in enterprise AI agents

At a glance

What this is: This is HiddenLayer’s analysis of the “Lethal Trifecta” in AI agents, showing how private data, untrusted content, and external communication combine into a single exploitation path.

Why it matters: It matters because IAM, PAM, and NHI teams now have to govern agent runtime behaviour, not just credentials and static permissions, across human, machine, and autonomous programmes.

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

👉 Read HiddenLayer's analysis of the lethal trifecta in enterprise AI agents

Context

AI agent identity risk is no longer limited to whether a model can answer a prompt. The governance problem is that an agent with access to private data, exposure to untrusted content, and a channel for external communication can be turned into an action path for exfiltration, unauthorised messaging, or downstream operations.

For identity and access teams, that shifts the question from static permissioning to runtime control. The same trust assumptions that work for human users and conventional service accounts break down when an AI system can ingest new context, reinterpret instructions, and act immediately across connected tools.

Key questions

Q: How should security teams govern AI agents that can read private data and use external tools?

A: Security teams should govern AI agents as non-human identities with explicit runtime boundaries. Separate what the agent may read from what it may send, require provenance checks on untrusted inputs, and log every outbound action. If data access and external communication are bundled, prompt injection can turn ordinary context into unauthorized disclosure.

Q: Why do AI agents create new risk even when no code vulnerability exists?

A: AI agents create risk because the exploit path can live in the context, not the code. An attacker only needs to influence what the agent reads and how it interprets that material. If the agent can then act externally, the poisoned context becomes an operational security event rather than a software flaw.

Q: What do security teams get wrong about prompt injection in agentic systems?

A: Teams often treat prompt injection as a content-filtering problem, but the real issue is delegated action. If the agent can combine private data, untrusted inputs, and external communication, the attack succeeds even when the underlying model is behaving exactly as designed. Governance has to cover the whole action chain.

Q: How should organisations limit damage if an AI agent is exposed to malicious content?

A: Organisations should restrict outbound privileges first, because external communication is what turns malicious context into impact. Keep sensitive data out of default context, segment tools by function, and force runtime approval for high-risk actions. That combination narrows the blast radius before the agent can complete a harmful sequence.

Technical breakdown

Private data plus tool access creates a new identity trust boundary

The first part of the lethal trifecta is not simply data access. It is private data combined with an actor that can use that data to decide what to do next. In agentic systems, private records, internal documents, and application context become both inputs and potential leakage material. Once an attacker can influence that context through injected prompts or poisoned content, the system can disclose or transform sensitive information without exploiting a classic software vulnerability. The risk sits in the decision layer, where the model interprets context and chooses actions.

Practical implication: define which private datasets an agent may read, transform, or export, and treat those permissions as runtime trust boundaries, not static entitlements.

Untrusted content turns model context into an attack surface

Untrusted content is dangerous because modern AI systems ingest more than human-approved prompts. They scrape web pages, read documents, consume tickets, and pull from protocol-connected sources such as MCP pipelines. That makes context transfer a security event, not a neutral workflow step. If one input contains hidden instructions, obfuscated payloads, or manipulated metadata, the agent may follow attacker logic instead of user intent. This is why inspection has to happen before and after context moves between systems. The issue is not just contamination, but propagation across linked agents and tools.

Practical implication: validate provenance and inspect context before it reaches the model, then re-check outputs before they are reused by other tools or agents.

External communication converts prompt injection into exfiltration

The final stage is when the system can act outside its own boundary. Email, API calls, webhooks, and message posts become the bridge between malicious context and real-world impact. A poisoned instruction only becomes a breach when the agent has a communication path that lets it transmit data or trigger operations beyond the immediate session. At enterprise scale, this can cascade through multiple agents and integrations, each carrying its own access scope. Traditional controls that watch endpoints or APIs miss the moment when reasoning becomes action.

Practical implication: separate read, decide, and send privileges so that no agent can both consume sensitive context and communicate externally without explicit runtime controls.

Threat narrative

Attacker objective: The attacker wants to convert legitimate agent access into unauthorized disclosure or action without needing to break the underlying application code.

1. Entry occurs when a poisoned prompt, document, web page, or other untrusted input reaches an agent that also has access to private enterprise context.
2. Credential or data abuse follows when the agent interprets that hostile context and uses its legitimate tool access to retrieve sensitive information or operational detail.
3. Impact occurs when the agent sends data externally, triggers downstream operations, or propagates malicious context through connected workflows and MCP-linked systems.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• AI LLM hijack breach — attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Lethal trifecta governance is a runtime problem, not a model-quality problem. The article is right to centre private data, untrusted content, and external communication because those three conditions create a complete exploitation path. In identity terms, the issue is not whether the agent can answer correctly, but whether its access, input handling, and outbound actions are governed as one trust boundary. That is the control plane IAM and PAM programmes now have to own.

Identity programmes still assume decision and action are separable events. That assumption was designed for human operators and conventional machine identities that request access, then use it later under predictable conditions. It fails when the actor can reinterpret context and act immediately, because the boundary between request, decision, and execution collapses into one runtime sequence. The implication is that recertification logic built around stable entitlements is not sufficient for agentic systems.

Context transfer is the named risk: trust does not survive uninspected movement between agents. MCP-style interoperability creates a propagation path where one contaminated input can become many contaminated decisions. That is why this class of risk belongs in OWASP-AGENTIC and OWASP-NHI thinking at the same time, with NIST-CSF and ZT-NIST-207 used to map control ownership across data flow, verification, and outbound action. Practitioners should treat context movement as an identity event, not just a content event.

Runtime governance now defines the blast radius of AI identity. If an agent can read private data and communicate externally, then the blast radius is determined by what it can select, transform, and send in a single interaction cycle. This is a different security shape from secret rotation or static privilege cleanup. The field should stop asking only whether an AI system is allowed to exist and start asking which actions it can complete before any human or policy gate can intervene.

Agentic AI and NHI governance are converging on the same operational question. A tool-connected model is already a non-human identity, and once it can decide and act without human approval, autonomous framing becomes mandatory. That means identity governance must span input provenance, tool authorization, and outbound control as a single lifecycle. The practical conclusion is simple: programmes that still separate AI governance from identity governance are already behind the risk surface.

From our research:

• 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, and 38% have no or low visibility, according to The State of Non-Human Identity Security.
• That same research found that a further 47% have only partial visibility, which means most programmes still cannot reliably see the full non-human access graph.
• For the next step, use Ultimate Guide to NHIs to map lifecycle controls across provisioning, rotation, and offboarding.

What this signals

Runtime governance is becoming the missing layer in AI security programmes. Teams that already manage NHI access will recognise the pattern, but the control model must now include context inspection and outbound gating, not just secrets and permissions. The practical shift is to treat agent execution as an identity event with provenance, authorisation, and egress controls attached to it.

Hidden context is the new expansion surface for identity risk. As AI systems consume more documents, web pages, and protocol-fed inputs, the attack surface grows through trust inheritance rather than through new infrastructure. That makes context flow mapping as important as access reviews, especially where an agent can forward data into other systems.

With 1 in 4 organisations already investing in dedicated NHI security capabilities, according to The State of Non-Human Identity Security, the market is moving toward broader identity governance for machines and agents. Security teams should prepare for controls that join NHI lifecycle, AI runtime policy, and Zero Trust verification in one operating model.

For practitioners

• Define separate read, decide, and send privileges Prevent any agent from consuming private data and communicating externally under the same entitlement set. Map each privilege to a distinct approval path, log source, and runtime policy so that one compromised context cannot directly become exfiltration.
• Inspect context before and after transfer Treat documents, web content, retrieved files, and MCP payloads as untrusted until provenance and intent have been validated. Re-check outputs before they are forwarded to other agents, tools, or downstream workflows.
• Limit agent access to private data Grant only the minimum dataset scope required for the task, and split high-value data from general assistant context wherever possible. If the agent does not need a record, keep it out of the model context entirely.
• Gate external communication paths Require explicit runtime controls before any agent can send email, trigger API calls, or post to webhooks. The goal is to prevent poisoned instructions from becoming irreversible outbound action.
• Review MCP-connected workflows as identity flows Trace every context-sharing hop between tools and agents, then document where untrusted content can enter and where sensitive data can leave. Apply the same scrutiny you would use for delegated access in a third-party integration chain.

Key takeaways

• The lethal trifecta works because access, trust, and egress are combined in one runtime path.
• The evidence points to a governance gap, not a model defect, because malicious context can become action without a code exploit.
• Practitioners need separate read, decide, and send controls if they want to keep agentic AI inside manageable blast radii.

Key terms

• Lethal Trifecta: A risk pattern where private data, untrusted content, and external communication exist in the same AI system. Together, they let malicious instructions travel from input to action without a traditional software exploit. In agentic environments, the phrase describes a runtime trust failure rather than a model defect.
• Context Poisoning: The manipulation of data, prompts, documents, or retrieved content so that an AI system acts on attacker-controlled instructions. The danger is not limited to the prompt itself. Once poisoned context is reused by tools or other agents, the impact can spread across the wider identity and workflow chain.
• Agentic Runtime Security: The control layer that inspects, constrains, and observes AI behaviour while the system is making decisions and calling tools. It focuses on what the agent can read, what it can do, and what it can send. For autonomous actors, this becomes an identity governance requirement, not an optional add-on.
• Context Transfer: The movement of prompts, documents, retrieved data, or memory between systems that feed an AI agent. Each transfer can change trust state, because the next system may interpret the same content differently. In practice, context transfer is where hidden instructions can propagate across agents and integrations.

What's in the full report

HiddenLayer's full research covers the operational detail this post intentionally leaves for the source:

• Runtime inspection logic for AI Guardrails, AI Firewall, and AI Detection & Response
• How Agentic & MCP Protection is positioned to validate context integrity across model and protocol layers
• The article's full examples of prompt injection paths through documents, web content, and connected agent workflows
• HiddenLayer's own runtime-layer framing for what to monitor when reasoning turns into action

👉 HiddenLayer's full research covers runtime inspection, MCP context transfer, and agentic defense controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.