The lethal trifecta: how AI assistants leak your data

If your assistant can read private data, read content from strangers and send something out, hidden instructions in that content can carry your data away. Three real incidents and seven fixes below.

Check my assistant (free) →

Published 9 October 2026 · Updated 16 October 2026

The short answer

🔒 Private data

Email, files, customer lists, databases, code repos.

📥 Untrusted content

Incoming email, web pages, PDFs, support tickets, comments.

📤 Outbound channel

Sending email, sharing, creating links, web fetch, opening PRs.

Language models cannot reliably tell your instructions apart from instructions inside the text they read. So an attacker hides instructions where your assistant will read them; the assistant finds your private data and sends it out. Simon Willison named this the “lethal trifecta” in 2025. In the OWASP Top 10 for LLM Applications 2025 it maps to LLM01 Prompt Injection and LLM02 Sensitive Information Disclosure.

It has already happened

EchoLeak · Microsoft 365 Copilot · June 2025

A single email with hidden instructions could make Copilot exfiltrate organisational data with no click (CVE-2025-32711, CVSS 9.3). Found by Aim Security, patched by Microsoft.

Entry: email · Data: org documents · Exit: URLs

GitHub MCP · May 2025

A malicious issue in a public repo hijacked the agent reading it, which wrote data from the user’s private repos into a public PR (Invariant Labs).

Entry: issue · Data: private repos · Exit: public PR

Supabase MCP · July 2025

Instructions in a support ticket made a coding assistant connected with the full-privilege service_role role read a secret tokens table and post it into the same ticket (General Analysis).

Entry: ticket · Data: tokens table · Exit: same ticket

Seven fixes

Cut one leg. The most effective fix. Disable outbound tools (send email, share, web fetch) or run the assistant in a read-only role.
Require approval before sending. Turn on “ask every time” for send, share, payment and command tools. Avoid “always allow for this session”.
Split the work. Give the job that reads outside content (incoming email, tickets, web pages) to a separate assistant with no access to your private data.
Narrow permissions. Grant one project folder, not your whole drive or home directory. Use a read-only role scoped to one project instead of a full-privilege database key.
Remove secrets from config files. Don’t write API keys in plain text; if the file was ever shared, rotate the key and load it from an environment variable.
Pin package versions. Unpinned installs like “npx -y package” can silently change if the publisher account is compromised. Pin an exact version.
Re-check on every new connection. One new connection can open the trifecta. Re-run the check whenever you add a tool or MCP server.

Check it in 30 seconds

The Agent Safety Card reads your assistant’s connections or your MCP config (Claude Desktop, Cursor, VS Code, Claude Code) and returns a 0–100 risk score, the leak path and a fix plan. Nothing is uploaded.

Open the Agent Safety Card →

FAQ

What is the lethal trifecta?

An AI assistant that has (1) access to private data, (2) exposure to untrusted content and (3) a way to communicate externally. Together, hidden instructions in the content can make the assistant send your data out. Simon Willison named the pattern in 2025.

Will a better model fix it?

Not on its own. In the documented incidents the problem was the combination of connections, not a model bug; Invariant Labs described the GitHub case as an architectural issue. The fix is to cut at least one leg.

Am I at risk with ChatGPT, Claude or Copilot?

It depends on what you connected. Plain chat is low risk. If the same assistant reads your email or documents, browses the web and can send things, the trifecta may be open. The Agent Safety Card checks it in 30 seconds.

What is MCP and why does it matter?

The Model Context Protocol is an open standard for connecting AI assistants to tools and data. Apps like Claude Desktop, Cursor and VS Code keep these connections in a config file, which is the most precise place to see what your assistant can reach.

Sources

How this guide was prepared

Prepared by: ASİ Dijital team, Hatay, Türkiye. We build guides and free checking tools that help businesses set up AI assistants more safely.
How was it checked?: Incident details (dates, CVE number, CVSS score) were taken from the original publications linked in the source list above; the fixes are a plain-language summary drawn from these incidents and the OWASP list. No statistics or success rates are given. Our publishing principles (in Turkish): yayın ilkelerimiz.
AI use: Drafts and checklists are prepared with help from AI tools. Facts are compared with their sources before publishing; unchecked AI output is not published.
Dates: Published 9 October 2026 · Updated 16 October 2026
Spotted an error?: Write to hatice@asidijital.com; we check it against the source, fix it and update the date.

Informational only, not legal or professional advice. Türkçe sürüm