The deadly duo describes an LLM system that combines untrusted content with privileged actions, even without direct access to private data. If the model can read attacker-controlled input and then act on it, it may make destructive queries, invoke tools, or trigger harmful operations on behalf of the attacker.
Expanded Definition
Deadly Duo is a failure pattern in which an LLM is allowed to process attacker-controlled or otherwise untrusted input and then use that input to drive privileged behavior. The core issue is not just that the model can read malicious text, but that it can convert that text into action through tools, queries, workflows, or system commands.
This is best understood as a boundary problem between interpretation and execution. The model may not need direct access to sensitive data for the risk to exist: if it can reach a database, ticketing system, email client, code repository, or automation interface, it can be induced to take harmful steps within that authority. The concept is closely related to prompt injection, but the broader failure is the combination of untrusted instructions and execution capability. In guidance terms, the security community is aligned that this pattern is dangerous; the practical debate is usually about where to place the trust boundary, not whether one exists.
A common misunderstanding is to assume that removing sensitive context solves the problem. It does not. If untrusted content can still influence privileged actions, the system remains exposed.
Examples and Use Cases
Deadly Duo appears anywhere an LLM can both ingest content and operate tools. The risk is shaped by what the model is authorised to do, not by whether the attacker can see the same data.
- An assistant reads a user message and then drafts a support ticket or refund action based on the text, allowing abuse through manipulative instructions.
- A retrieval-enabled chatbot processes a poisoned document and then issues follow-on searches or updates that reflect the attacker’s embedded directives.
- An AI agent can send emails, open cases, or edit records after interpreting hostile input, creating an execution path from text to action.
- An internal copilot summarises a request and then performs a destructive administrative query because the prompt included misleading operational instructions.
The main tradeoff is usefulness versus containment. The more directly an LLM can act on behalf of the user, the more easily it can be steered into unsafe actions if the input boundary is weak. For readers studying the identity side of this problem, OWASP Non-Human Identity Top 10 is useful because privileged agents and service identities are often what make the action step possible.
Security Implications
When Deadly Duo is misunderstood, the failure is usually an over-trust of model output. Organisations may test whether the model can leak data, yet miss the more practical danger that it can be steered into making legitimate calls, destructive updates, or policy-breaking decisions using its own authority.
This creates a high-impact control failure because the attack path is indirect. The attacker does not need to break encryption or bypass authentication if the model can already reach a privileged tool and is willing to follow malicious instructions hidden in content, attachments, web pages, or retrieved documents. The observable symptoms are often confusing: unexpected searches, malformed requests, unauthorized workflow transitions, or actions that look “user initiated” unless the system preserves strong provenance.
Practitioners should treat this as an execution integrity problem. The dangerous moment is not only model hallucination, but model-mediated action taken in response to untrusted input. That is why logging, approval boundaries, and tool scoping matter as much as prompt quality.
Domain and Governance Relevance
Deadly Duo matters most in AI security and adjacent identity governance, where autonomous or semi-autonomous systems are given operational authority. Once an LLM can invoke tools, its effective privilege becomes part of the control surface, and governance has to cover both the model’s inputs and the permissions behind its actions.
For NHI and agentic environments, the key change is that the “actor” is no longer only a human user. The model may operate through a service account, workload identity, or delegated token, so access review must consider whether the identity is safe for the tasks the system can reach. In that sense, the issue is not merely prompt safety. It is the alignment of untrusted content, execution scope, and accountable machine identity.
The practical boundary is simple: if an LLM can both read and act, the organisation must govern that path as a security control, not as a convenience feature.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and MITRE ATLAS address the attack and risk surface, while NIST AI 600-1, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Secrets and Credential Management | Privileged LLM actions depend on machine credentials and delegated access. |
| NHI-02 — Identity Lifecycle and Ownership | Deadly Duo becomes worse when service identities lack clear ownership and review. | |
| Recommendation — Scope and rotate machine credentials so LLM tools cannot execute beyond intended authority. Assign ownership for every agent identity and revoke unused access paths promptly. | ||
| OWASP Agentic AI Top 10 | A2 — Tool and Action Authorization | The pattern is about untrusted input driving privileged tool use. |
| A4 — Prompt Injection and Instruction Hijacking | Deadly Duo is commonly triggered by attacker-controlled instructions in content. | |
| Recommendation — Restrict tool execution to explicitly authorised actions and require trust boundaries. Detect and neutralise instruction-hijacking content before it reaches action-capable agents. | ||
| MITRE ATLAS | AML.TA0002 — Evasion | Attackers hide malicious instructions in content to steer model behavior. |
| Recommendation — Hunt for content-based evasion that redirects agent behaviour through untrusted text. | ||
| NIST AI 600-1 | MAP — Measure, Assess, and Manage AI Risk | The term concerns a concrete AI risk from untrusted input and tool execution. |
| Recommendation — Assess agent workflows for input-to-action failures and reduce unsafe autonomous reach. | ||
| NIST CSF 2.0 | PR.AC — Access Control | Deadly Duo is constrained by how much authority the model can exercise. |
| DE.CM — Continuous Monitoring | Unsafe tool calls from model-driven workflows must be observable. | |
| Recommendation — Limit model and tool access to the minimum authority needed for each workflow. Monitor agent actions for unexpected queries, updates, and workflow transitions. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 7, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
