Lethal trifecta exposure in AI agents: are your controls keeping up?

TL;DR: 98% of 100 production AI agents carried the lethal trifecta of private data access, untrusted content exposure, and external communication, while only 11% met baseline security expectations, according to DTEX reports. That combination turns delegated AI activity into a default insider-risk condition, not a fringe exception.

Editorial analysis by NHI Mgmt Group, based on content published by DTEX: “98% of AI Agents Are Living in the Lethal Trifecta. Here’s What That Means for Insider Risk”.

By the numbers:

• 98% of the agents evaluated had simultaneous access to private data, exposure to untrusted external content, and the ability to take outbound action.
• Only 11% of the agents assessed passed a baseline security benchmark.
• 40% of the population studied were exposed giants but accounted for 60% of the aggregate risk.

Key questions

Q: What breaks when AI agents can read data, ingest untrusted content, and communicate externally in one workflow?

A: The control boundary breaks because the agent can turn malicious content into action while still holding delegated access to sensitive data.

Q: Why does delegated AI activity create insider risk instead of only model risk?

A: Because the agent is acting on behalf of a user or workflow, the key question becomes who moved the data and whether that action was authorised.

Q: What are the signs that AI agent risk is being underestimated?

A: The clearest signs are self-serve deployment, strong claims about security without independent testing, and broad access that exceeds the user’s normal task scope.

Practitioner guidance

• Map every agent workflow that combines reading, tool use, and outbound communication Identify where an agent can access private data, ingest untrusted content, and transmit externally in the same task chain, then classify the workflow by exposure level.
• Separate prevention controls from logging controls Test whether the environment can block unsafe tool calls or outbound movement before execution, rather than relying on audit logs to reconstruct a completed action.
• Limit delegated access to task-scoped authority Remove standing permission where the agent does not need persistent access, and require explicit policy evaluation at the action level for sensitive operations.

Bottom line: AI agents are already operating with a combination of data access, untrusted input, and outbound reach that creates insider-risk conditions, not theoretical future exposure.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →