Can your AI assistant leak your data?
Paste your config file; see your risk, the leak path and the fix. Free — nothing leaves your browser.
How does it work? Read The lethal trifecta: how AI assistants leak your data. Rules updated: 11 October 2026 · 25 server families · 4 documented incidents.
FAQ
What is the “lethal trifecta”?
When an AI assistant can (1) access your private data, (2) read untrusted content and (3) send data out, hidden instructions in that content can make it exfiltrate your data. Simon Willison named the pattern in 2025.
Does this tool scan my systems?
No. It connects to nothing and performs no attacks. It only looks at what you tick and the config you paste, and everything is processed in your browser. Nothing is sent anywhere.
Which config files work?
Any JSON with “mcpServers” or “servers”: Claude Desktop (claude_desktop_config.json), Cursor (.cursor/mcp.json), VS Code (.vscode/mcp.json), Claude Code (.mcp.json), Windsurf and similar.
My result is red. What now?
Cut one leg of the trifecta: disable outbound tools or require approval for each send, or move the work that reads untrusted content to a separate assistant with no access to your private data.
Need a review of your company’s AI agents, with written authorisation? ASİ Agent Security · hatice@asidijital.com · Privacy (TR)